Complete feed
Security advisories & CVEs
97 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Low [CVE-2025-71346] Heap buffer under-read in XML Schema validation
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8) that contains a heap-based buffer under-read (CVE-2025-32415) in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating untrusted documents against trusted schemas that use xsd:keyref in combination with recursively defined types that have additional identity constraints. Upstream and MITRE rate this issue as low severity. This heap-based buffer under-read vulnerability, located in the xmlSchemaIDCFillNodeTables function, can be triggered when processing untrusted XML Schemas or documents. A remote attacker could exploit this by providing specially crafted XML input, which may lead to unexpected application behavior or a limited denial of service (DoS). Red Hat severity: Low — CVSS 2.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-125. Affected Red Hat products: Red Hat 3scale API Management Platform 2; Red Hat Satellite 6. Will not fix / out of support: Red Hat 3scale API Management Platform 2. Red Hat does not currently list a fixing RHSA for this CVE.
Low [CVE-2026-77648] Server-Side Request Forgery allows internal URL access by administrators
Server-Side Request Forgery allows internal URL access by administrators. Red Hat rates this low (CVSS 2.2). Weakness: CWE-918.
Low [CVE-2026-53584] Submodule path traversal allows arbitrary directory creation
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from.gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5. A flaw was found in libgit2. By crafting a malicious repository that specifies traversal components in a submodule path, applications initializing the submodule can be tricked into creating directories in arbitrary locations on the file system. This could lead to unintended file system modifications or potentially further compromise. Red Hat severity: Low — CVSS 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3. Red Hat fixing advisory: RHSA-2026:59361. Affected products named by the advisory: Red Hat package: rust; Red Hat package: libgit2.
Low [CVE-2026-76891] Denial of Service via sharkd crash
Denial of Service via sharkd crash. Red Hat rates this low (CVSS 3.1). Weakness: CWE-248. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: wireshark.
Low [CVE-2026-76885] Denial of Service via Tektronix K12xx file parsing
Denial of Service via Tektronix K12xx file parsing. Red Hat rates this low (CVSS 3.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: wireshark.
Low [CVE-2026-76888] Heap-based Buffer Overflow in RDP dissector leads to Denial of Service
Heap-based Buffer Overflow in RDP dissector leads to Denial of Service. Red Hat rates this low (CVSS 3.1). Weakness: CWE-120. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: wireshark.
Low [CVE-2026-76887] Denial of service via heap-based buffer overflow in dissection engine
Denial of service via heap-based buffer overflow in dissection engine. Red Hat rates this low (CVSS 3.1). Weakness: CWE-120. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: wireshark.
Low [CVE-2026-76884] Denial of Service via ERF file parser crash
Denial of Service via ERF file parser crash. Red Hat rates this low (CVSS 3.3). Weakness: CWE-130. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: wireshark.
Low [CVE-2026-63632] Denial of Service via out-of-bounds read in version converter
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() in onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has input tensors with fewer than two dimensions because B_shape[1], A_shape[0], or A_shape[1] is accessed without a rank check, potentially causing a process crash during an opset 7 to 6 downgrade. This issue is fixed in version 1.22.0. This vulnerability, caused by a lack of rank checking, could allow an attacker to trigger a process crash during an opset 7 to 6 downgrade, leading to a Denial of Service (DoS). Red Hat severity: Low — CVSS 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Weakness: CWE-125. Affected Red Hat products: Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Low [CVE-2026-74985] Privilege escalation in the Enterprise Policies component
Privilege escalation in the Enterprise Policies component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-266.
Low [CVE-2026-74986] Site isolation issue in the CSS Parsing and Computation component
Site isolation issue in the CSS Parsing and Computation component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-501.
Low [CVE-2026-74984] Race condition in the JavaScript Engine component
Race condition in the JavaScript Engine component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-366.
Low [CVE-2026-74981] Site isolation issue in the Audio/Video: Web Codecs component
Site isolation issue in the Audio/Video: Web Codecs component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-501.
Low [CVE-2026-74980] Clickjacking issue in the Downloads component in Firefox for Android
Clickjacking issue in the Downloads component in Firefox for Android. Red Hat rates this low (CVSS 3.4). Weakness: CWE-1021.
Low [CVE-2026-74982] Denial-of-service in the Widget component
Denial-of-service in the Widget component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-770.
Low [CVE-2026-74977] Integer overflow in the Graphics component
Integer overflow in the Graphics component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-190.
Low [CVE-2026-74978] Clickjacking issue in the Widget component
Clickjacking issue in the Widget component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-1021.
Low [CVE-2026-74979] Mitigation bypass in the Add-ons Manager component
Mitigation bypass in the Add-ons Manager component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-807.
Low [CVE-2026-74975] Spoofing issue in the Downloads component in Firefox for Android
Spoofing issue in the Downloads component in Firefox for Android. Red Hat rates this low (CVSS 3.4). Weakness: CWE-494.
Low [CVE-2026-74983] Mitigation bypass in the Data Loss Prevention component
Mitigation bypass in the Data Loss Prevention component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-807. Red Hat lists fixing advisory RHSA-2026:58897 with package firefox-0:140.14.0-1.el10_2, firefox-0:140.14.0-1.el8_10, firefox-0:140.14.0-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.