Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-19027] Information disclosure and denial of service via crafted HDF5 file
Information disclosure and denial of service via crafted HDF5 file. Red Hat rates this moderate (CVSS 5.6). Weakness: CWE-125.
Medium [CVE-2026-19026] Denial of service via crafted HDF5 file
Denial of service via crafted HDF5 file. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images.
Medium [CVE-2026-19025] Denial of Service due to malformed chunk data in files
Denial of Service due to malformed chunk data in files. Red Hat rates this moderate (CVSS 5). Weakness: CWE-369. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images.
Medium [CVE-2026-19024] Denial of service via malformed dataset
Denial of service via malformed dataset. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Affected product named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3.
Medium [CVE-2026-71313] Path Traversal allows arbitrary file write
Path Traversal allows arbitrary file write. Red Hat rates this moderate (CVSS 6.9). Weakness: CWE-22. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
Medium [CVE-2026-71311] FTP command injection via CRLF in filename encoding
FTP command injection via CRLF in filename encoding. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-93.
Medium [CVE-2026-71310] Denial of Service via unbounded HTTP CONNECT response headers
Denial of Service via unbounded HTTP CONNECT response headers. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
Medium [CVE-2026-70429] Privilege escalation via inconsistent case sensitivity in user and group names
Privilege escalation via inconsistent case sensitivity in user and group names. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-178. Red Hat lists fixing advisory RHSA-2026:60250 with package ocp-tools-4/jenkins-rhel8:1786533565, ocp-tools-4/jenkins-rhel9:1787124635, ocp-tools-4/jenkins-rhel9:1787124925, ocp-tools-4/jenkins-rhel9:1787125069. Affected product named by the advisory: OpenShift Developer Tools and Services.
Medium [CVE-2026-20311] Cisco IOS XE Software Web-Based Management Interface Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient error handling in the web-based management interface. An attacker could exploit this vulnerability by authenticating with a malformed certificate. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Medium [CVE-2026-20198] Cisco Integrated Management Controller Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Affected products named by the advisory: Unified Computing System (Standalone); Unified Computing System E-Series Software (UCSE); Enterprise NFV Infrastructure Software.
Medium [CVE-2026-20289] Cisco RoomOS Logging Subsystem Information Disclosure Vulnerability
A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. An attacker could exploit this vulnerability by enabling a specific logging level and then collecting the system logs. A successful exploit could allow the attacker to view sensitive information like user login credentials. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Affected product named by the advisory: RoomOS Software.
Medium [CVE-2026-20294] Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types that are not included in the encryption allowlist. A low-privileged attacker could exploit this vulnerability by viewing logs on the local system or on a remote logging server. A successful exploit could allow the attacker to view sensitive authentication credentials, which could lead to further compromise of network infrastructure and connected services. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Medium [CVE-2026-20028] Cisco Terminal Services Agent Firewall Rules Bypass Vulnerability
A vulnerability in the network driver of Cisco Terminal Service (TS) Agent could allow an authenticated, remote attacker to bypass firewall rules that are associated with the account of the attacker. This vulnerability is due to an incorrect mapping of network connections to user accounts. An attacker with at least user-level credentials could exploit this vulnerability by sending crafted network traffic to an affected device. A successful exploit could allow the attacker to inherit the firewall rules associated with a different user in the system. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Affected product named by the advisory: Terminal Services Agent.
Medium [CVE-2026-20308] Cisco IOS XE Software Web-Based Management Interface Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to perform a denial of service (DoS) attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web-based management interface of an affected device. A successful exploit could allow the attacker to cause the web-based management interface to become unresponsive. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Affected products named by the advisory: Aironet Access Point Software (IOS XE Controller); IOS XE Catalyst SD-WAN; IOS XE Software Bootloader (ROMMON); IOS XG Software; and 1 more.
Medium [CVE-2026-50749] Improper Authorization vulnerability in Apache Answer
Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Medium [CVE-2026-48912] Improper Input Validation vulnerability in Apache Answer
Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Medium [CVE-2026-49331] unauthenticated identity header injection on whitelisted paths
unauthenticated identity header injection on whitelisted paths. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-345. Affected product named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2026-16100] Unbounded metric cardinality in user event metrics via request-controlled error text
Unbounded metric cardinality in user event metrics via request-controlled error text. Red Hat rates this moderate (CVSS 6.5). Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, keycloak-services, rhbk/keycloak-rhel9-operator:26.6-11. Affected product named by the advisory: Red Hat build of Keycloak 26.6.
Medium [CVE-2026-16071] LDAP entry-DN user search bypasses configured users DN boundary
LDAP entry-DN user search bypasses configured users DN boundary. Red Hat rates this moderate (CVSS 5.4). Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, keycloak-services. Affected products named by the advisory: Red Hat build of Keycloak 26.4.14; Red Hat build of Keycloak 26.6.5.
Medium [CVE-2026-71227] Infinite loop denial of service in libkcapi _kcapi_aio_read_all due to unhandled io_getevents timeout return
Infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return. Red Hat rates this moderate (CVSS 5.1). Weakness: CWE-835. Red Hat lists fixing advisory RHSA-2026:56985 with package libkcapi-main-1.5.1-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.