Complete feed
No mitigation yet
No fix, workaround or mitigation extracted yet
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Critical [CVE-2026-109618 +1] PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
CVSSv3 Score: 9.8 CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Revised on 2026-10-21 00:00:00
Critical [CVE-2026-99999] Linux Kernel Vulnerability in NetApp Products
Linux kernel versions 2.6.27 through 5.10.271, 5.11 through 5.15.222, 5.16 through 6.1.189, 6.2 through 6.6.158, 6.7 through 6.12.112, 6.13 through 6.18.56, 6.19 through 7.2.10 and 7.3 through 7.3-rc6 are susceptible to a vulnerability known as PwnEscape, a guest-to-host escape vulnerability. Successful exploitation could allow a local attacker or untrusted guest virtual machine to perform arbitrary code execution on the host. Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data or Denial of Service (DoS). Affected products: ONTAP Select Deploy administration utility. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
High [CVE-2026-48798] SSH.NET Vulnerability in NetApp Products
SSH.NET versions through 2025.1.0 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data or Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-17557] SSRF via job-spec model.url with bearer credential forwarding
SSRF via job-spec model.url with bearer credential forwarding. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-918. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-34743] XZ Utils Vulnerability in NetApp Products
XZ Utils versions prior to 5.8.3 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-0864] Python Vulnerability in NetApp Products
Python versions through 3.10.20, 3.11.0 through 3.11.15, 3.12.0 through 3.12.13, 3.13.0 through 3.12.13, 3.13.0 through 3.13.14, 3.14.0 through 3.14.6 and 3.15.0-a1 through 3.15.0-b3 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data. Successful exploitation of this vulnerability could lead to addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2024-8184] Jetty Vulnerability in NetApp Products
Jetty versions 12.0.0 through 12.0.8, 11.0.0 through 11.0.23, 10.0.0 through 10.0.23 and 9.3.12 through 9.4.55 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Active IQ Unified Manager for Linux, Active IQ Unified Manager for Microsoft Windows, Active IQ Unified Manager for VMware vSphere. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-2100] P11-kit Vulnerability in NetApp Products
P11-kit versions through 0.26.1 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2025-49128] Jackson-Core Vulnerability in NetApp Products
Jackson-core versions through 2.12.7 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information. Successful exploitation of this vulnerability could lead to disclosure of sensitive information. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2025-60876] BusyBox Vulnerability in NetApp Products
BusyBox versions through 1.37.0 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information or addition or modification of data. Affected products: NetApp HCI Baseboard Management Controller (BMC) - H610S. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-29111] Systemd Vulnerability in NetApp Products
Systemd versions 239 through 257.10, 258-rc1 through 258.4, 259-rc1 through 259.1, and 260-rc1 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-13346] Pip Vulnerability in NetApp Products
pip versions through 26.1.2 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data. Successful exploitation of this vulnerability could lead to addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-41411] Vim Vulnerability in NetApp Products
Vim versions prior to 9.2.0357 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data or Denial of Service (DoS). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2025-12084] Python Vulnerability in NetApp Products
Python versions prior to 3.13.11, 3.14.0 prior to 3.14.2 and 3.15.0:a1 prior to 3.15.0:a3 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: Management Services for Element Software and NetApp HCI. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Medium [CVE-2026-34757] LIBPNG Vulnerability in NetApp Products
LIBPNG versions 1.0.9 prior to 1.6.57 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information or addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
Low [CVE-2026-114370] Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal
A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory. The Red Hat Product Security team has assessed the severity of this vulnerability as Low, given that exploitation requires a specific configuration involving symbolic links and specific directory naming patterns. Successful exploitation allows an attacker to read files from unauthorized sibling directories that share a name prefix with a configured safe path. The vulnerabilitys root cause is an improper path validation logic in the PathResourceManager that uses string prefix matching instead of path-segment aware validation. Weakness: CWE-22. Affected Red Hat products: Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat Single Sign-On 7. Under investigation: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Low [CVE-2026-114236] Goroutine/file-descriptor leak in storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer on malformed layers
Goroutine/file-descriptor leak in storage/pkg/archive. ApplyLayer and ApplyUncompressedLayer on malformed layers. Red Hat rates this low (CVSS 3.3). Weakness: CWE-772. Affected products named by the advisory: Confidential Compute Attestation; DPU kit for NVIDIA; Exploit Intelligence; Multicluster Engine for Kubernetes; and 19 more. Affected products named by the advisory: NVIDIA JetPack 6 for RHEL; OpenShift Lightspeed; OpenShift Source-to-Image (S2I); Red Hat Advanced Cluster Security 4; and 15 more.
High [CVE-2026-113812] Mozilla::CA: TLS server impersonation via compromised intermediate certificates
Mozilla::CA: TLS server impersonation via compromised intermediate certificates. Red Hat rates this important (CVSS 7.4). Weakness: CWE-295. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat package: perl-mozilla-ca.
High [CVE-2026-113274] Use after free in ReadingMode
Use after free in ReadingMode. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825.
High [CVE-2026-113039] Use after free in Bookmarks
Use after free in Bookmarks. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825.