Complete feed
Security advisories & CVEs
3241 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-74610] don't leave a full plaintext sk_msg ring unpushed
don't leave a full plaintext sk_msg ring unpushed. Red Hat rates this moderate (CVSS 7). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: kernel.
High [CVE-2026-74705] fix potential use-after-free in tunnel segmentation
fix potential use-after-free in tunnel segmentation. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-74637] Fix group leader use-after-free after sibling detach
Fix group leader use-after-free after sibling detach. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
Medium [CVE-2026-70626] Information disclosure via symlink escape in CorpusReader.open
NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary. A flaw was found in NLTK. By placing symbolic links (symlinks) within the corpus root, an attacker can bypass path validation in the `CorpusReader.open()` function, which does not properly account for symlink resolution. This could lead to unauthorized information disclosure. The vulnerability arises from improper path validation in CorpusReader.open() when handling symlinks, enabling an attacker with local access to bypass security restrictions and access sensitive data. This affects components within Red Hat Ansible Automation Platform and Red Hat OpenShift AI that utilize the vulnerable NLTK library. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22. Red Hat lists Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI) as not affected.
Medium [CVE-2026-65915] Arbitrary file read due to logic bug in FileSystemPathPointer
NLTK versions before 3.10.0 contain a logic bug in FileSystemPathPointer.open() where the sandbox validation check compares a normalized path against itself, making the security check permanently inert. Attackers can pass file:// URLs to nltk.data.load() to read arbitrary files accessible to the process user, including credentials and configuration files. A flaw was found in NLTK. A remote attacker can exploit this by providing specially crafted `file://` Uniform Resource Locators (URLs) to `nltk.data.load()`. This enables the attacker to read arbitrary files on the system, potentially leading to the disclosure of sensitive information such as credentials and configuration files. This could lead to information disclosure, including sensitive credentials or configuration data, within affected Red Hat products such as Lightspeed Core, OpenShift Lightspeed, Red Hat Ansible Automation Platform, and Red Hat OpenShift AI. Exploitation requires the application to process untrusted input that can be interpreted as a `file://` URL by NLTK. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22. Red Hat lists OpenShift Lightspeed as not affected. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Exploit Intelligence; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-63311] Server-Side Request Forgery bypass via DNS resolution failures
NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebinding can bypass SSRF protections and reach restricted network resources, including cloud metadata endpoints (e.g., 169.254.169.254). A flaw was found in NLTK. This server-side request forgery (SSRF) vulnerability allows an attacker to bypass network access restrictions. By triggering DNS resolution failures or using DNS rebinding, an attacker can cause the `validate_network_url()` function to incorrectly validate URLs. This flaw in NLTK allows a server-side request forgery (SSRF) bypass when DNS resolution fails or through DNS rebinding. This could enable an attacker to access restricted internal network resources, including cloud metadata endpoints, within Red Hat environments utilizing affected NLTK versions. Red Hat severity: Moderate — CVSS 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-918.
Medium [CVE-2026-62385] Information disclosure through path traversal
NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit frame_by_name, doc, lu, and header methods with crafted parameters to read arbitrary XML files accessible to the application. A flaw was found in NLTK. This path traversal vulnerability, located in the FramenetCorpusReader and NKJPCorpusReader components, allows an attacker to read arbitrary XML files accessible to the application. This can be achieved by supplying unsafe selectors or poisoned index state, exploiting methods such as `frame_by_name`, `doc`, `lu`, and `header` with specially crafted parameters. The primary consequence is information disclosure. Successful exploitation requires an application to process specially crafted input through the vulnerable NLTK components. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22. Red Hat lists Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI) as not affected.
Medium [CVE-2026-62383] Information disclosure via symlink in IPIPANCorpusReader
nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels(), domains(), categories(), or fileids() methods with the symlink filename. A flaw was found in nltk. A local attacker can exploit a symlink-based vulnerability in the IPIPANCorpusReader methods. By placing a symbolic link in the corpus root directory and invoking specific methods, an attacker can bypass security validation and read arbitrary files accessible to the process. This could lead to unauthorized information disclosure. The `nltk` library is vulnerable to information disclosure, allowing an attacker with local access and low privileges to read arbitrary files. This occurs if an attacker can place a symlink within the `nltk` corpus root directory, bypassing path validation and enabling access to sensitive data with the permissions of the running process. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22. Red Hat lists Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI) as not affected.
Medium [CVE-2026-74584] zero shared page before exposing to userspace
zero shared page before exposing to userspace. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-908. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-74595] use the mount idmap for the owner check in fscrypt_ioctl_set_policy
use the mount idmap for the owner check in fscrypt_ioctl_set_policy(). Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-628. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
Medium [CVE-2026-74607] Serialize accesses to the owner and mirror list with separate lock
Serialize accesses to the owner and mirror list with separate lock. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-366. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
Medium [CVE-2026-74625] release template ct on non-IP path
release template ct on non-IP path. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-772. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
Medium [CVE-2026-74638] Serialize the scheduler timeout handlers
Serialize the scheduler timeout handlers. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-367.
Medium [CVE-2026-74729] Fix usercopy overflow in snoop_file_read
Fix usercopy overflow in snoop_file_read. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125.
Medium [CVE-2026-74664] reallocate update replies for mismatched IDs
reallocate update replies for mismatched IDs. Red Hat rates this low (CVSS 5.5). Weakness: CWE-131. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
Medium [CVE-2026-74683] evdev - sanitize event type index when fetching event masks
evdev - sanitize event type index when fetching event masks. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
Medium [CVE-2026-74712] Fix buffer length in create_direct_keys
Fix buffer length in create_direct_keys(). Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: kernel.
Medium [CVE-2026-74599] always stabilise against page table freeing using init_mm
always stabilise against page table freeing using init_mm. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-413. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-74632] fix huge_zero_pfn race
fix huge_zero_pfn race. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-367. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
Medium [CVE-2026-74606] Fix use-after-free in eventfs_remove_rec
Fix use-after-free in eventfs_remove_rec(). Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: kernel.