Complete feed
Security advisories & CVEs
5237 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2025-55130] Nodejs file permissions bypass
Nodejs file permissions bypass. Red Hat rates this important (CVSS 7.1). Weakness: CWE-281. Affected package(s): nodejs22, nodejs:20, nodejs:22, nodejs25-main, nodejs:24, nodejs24-main. Resolved in Red Hat advisory RHSA-2026:1842 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 9.6 Extended Update Support; and 1 more.
High [CVE-2026-23876] Arbitrary code execution via a crafted XBM image file
Arbitrary code execution via a crafted XBM image file. Red Hat rates this important (CVSS 8.1). Weakness: CWE-787. Affected package(s): ImageMagick. Resolved in Red Hat advisory RHSA-2026:3058 — update the affected packages (`sudo dnf update`). Affected product named by the advisory: Red Hat Enterprise Linux 7 Extended Lifecycle Support.
High [CVE-2026-23950] Arbitrary file overwrite via Unicode path collision race condition
Arbitrary file overwrite via Unicode path collision race condition. Red Hat rates this important (CVSS 8.8). Weakness: CWE-367. Affected package(s): devspaces/udi-rhel9:1774451954, rhtas/rekor-search-ui-rhel9:1770107452, rhtas/rekor-search-ui-rhel9:1770739056, linux-sgx. Resolved in Red Hat advisory RHSA-2026:18868 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Dev Spaces 3.27; Red Hat Trusted Artifact Signer 1.2; and 17 more.
High [CVE-2026-23949] Path traversal via malicious tar archives
Path traversal via malicious tar archives. Red Hat rates this important (CVSS 8.6). Weakness: CWE-22. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2025-56005] Unsafe pickle file handling in Ply
Unsafe pickle file handling in Ply. Red Hat rates this important (CVSS 7.8). Weakness: CWE-502. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Migration Toolkit for Containers; OpenShift Developer Tools and Services; OpenShift Pipelines; Red Hat Advanced Cluster Security 4; and 14 more.
Medium [CVE-2026-0672] Header injection in http.cookies.Morsel in Python
Header injection in http.cookies. Morsel in Python. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-93. Affected package(s): python3.12, rhui5/rhua-rhel9:1779798222, rhui5/installer-rhel9:1779798165. Resolved in Red Hat advisory RHSA-2026:19064 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8.
Medium [CVE-2025-15282] Header injection via newlines in data URL mediatype in Python
Header injection via newlines in data URL mediatype in Python. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-93. Affected package(s): python3.12, python3, rhui5/rhua-rhel9:1779798222, rhui5/installer-rhel9:1779798165. Resolved in Red Hat advisory RHSA-2026:19064 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8.
Medium [CVE-2026-0865] wsgiref.headers.Headers allows header newline injection in Python
wsgiref.headers. Headers allows header newline injection in Python. Red Hat rates this moderate (CVSS 4.5). Weakness: CWE-74. Affected package(s): python3.11, python3, rhui5/haproxy-rhel9:1779798164, rhui5/rhua-rhel9:1773670137, rhui5/rhua-rhel9:1779798222, python3.12. Resolved in Red Hat advisory RHSA-2026:2128 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 1.
Medium [CVE-2026-21925] Improve JMX connections (Oracle CPU 2026-01)
Improve JMX connections (Oracle CPU 2026-01). Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-322. Affected package(s): java. Resolved in Red Hat advisory RHSA-2026:0895 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
Medium [CVE-2026-21933] Improve HttpServer Request handling (Oracle CPU 2026-01)
Improve HttpServer Request handling (Oracle CPU 2026-01). Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-93. Affected package(s): java. Resolved in Red Hat advisory RHSA-2026:0895 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
Medium [CVE-2025-11468] Missing character filtering in Python
Missing character filtering in Python. Red Hat rates this moderate (CVSS 4.5). Weakness: CWE-140. Affected package(s): python3. Resolved in Red Hat advisory RHSA-2026:8824 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-55132] Nodejs filesystem permissions bypass
Nodejs filesystem permissions bypass. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-281. Affected package(s): nodejs25-main, nodejs22, nodejs:24, nodejs:22, nodejs24-main, nodejs20-main. Resolved in Red Hat advisory RHSA-2026:1842 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1.
Medium [CVE-2026-21637] Nodejs denial of service
Nodejs denial of service. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-248. Affected package(s): nodejs22, nodejs:20, nodejs:22, nodejs25-main, nodejs:24, nodejs24-main. Resolved in Red Hat advisory RHSA-2026:1842 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1.
Medium [CVE-2026-21636] Nodejs network segmentation bypass
Nodejs network segmentation bypass. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-281. Affected package(s): nodejs20-main, nodejs25-main, nodejs22-main, nodejs24-main. Resolved in Red Hat advisory RHSA-2026:6402 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-59466] Nodejs denial of service
Nodejs denial of service. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770. Affected package(s): nodejs22, nodejs:20, nodejs:22, nodejs25-main, nodejs:24, nodejs24-main. Resolved in Red Hat advisory RHSA-2026:1842 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1.
Medium [CVE-2025-59464] Nodejs memory leak
Nodejs memory leak. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770. Affected package(s): nodejs20-main, nodejs25-main, nodejs22-main, nodejs24-main. Resolved in Red Hat advisory RHSA-2026:7657 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-15281] wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory
wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory. Red Hat rates this low (CVSS 5.9). Weakness: CWE-908. Affected package(s): insights-proxy/insights-proxy-container-rhel9:1773685509, rhui5/rhua-rhel9:1773670137, glibc, discovery/discovery-server-rhel9:1773273243, discovery/discovery-ui-rhel9:1773273070, glibc-main. Resolved in Red Hat advisory RHSA-2026:18139 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 1.
Medium [CVE-2024-31884] Improper use of Pybind
Improper use of Pybind. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-295. Affected package(s): ceph, rhceph/rhceph. Resolved in Red Hat advisory RHSA-2026:2711 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1.
Medium [CVE-2026-21941] Optimizer unspecified vulnerability (CPU Jan 2026)
Optimizer unspecified vulnerability (CPU Jan 2026). Red Hat rates this moderate (CVSS 4.9). Affected package(s): mysql8.4, mysql:8.0, mysql, mysql:8.4. Resolved in Red Hat advisory RHSA-2026:5580 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
Medium [CVE-2026-21936] InnoDB unspecified vulnerability (CPU Jan 2026)
InnoDB unspecified vulnerability (CPU Jan 2026). Red Hat rates this moderate (CVSS 4.9). Affected package(s): mysql8.4, mysql:8.0, mysql, mysql:8.4. Resolved in Red Hat advisory RHSA-2026:5580 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.