CVE-2026-85769Medium 6.5Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize0.4%
CVE-2026-85534Medium 5.9Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read0.3%
CVE-2026-81666Medium 6.5Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems0.2%
CVE-2026-81665High 7.5Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly0.4%
CVE-2026-85197High 7.6Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload0.3%
CVE-2026-84185Medium 5.9Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification0.1%
CVE-2026-85150High 7.5Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header0.5%
CVE-2026-84838High 7.8Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()1.1%
CVE-2026-84837High 7.8Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path0.7%
CVE-2026-78409High 7.0Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks0.2%
CVE-2026-78410High 7.8Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection0.2%
CVE-2026-53683Medium 4.3Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html0.3%
CVE-2026-84270Medium 4.3Gvfs: mtp: out-of-bounds read in do_read()0.1%
CVE-2026-84269Medium 6.5Gvfs: afp: heap-based buffer overflow in dsi read path0.3%
CVE-2026-84267Medium 4.3Gvfs: sftp: uninitialized heap disclosure in read_string()0.2%
CVE-2026-84268High 8.8Gvfs: sftp: heap-based buffer overflow in read_reply()0.6%
CVE-2026-84233High 7.0Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames0.2%
CVE-2026-53682Medium 5.3Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts0.2%
CVE-2026-11873Medium 6.5Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure0.5%
CVE-2026-18743Low 2.5Popt-devel: popt-static: short realloc in poptconfigfiletostring0.1%
CVE-2026-13732High 7.0Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf0.1%
CVE-2026-81624High 7.5Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite0.6%
CVE-2026-82327Medium 5.5Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data0.2%
CVE-2026-80179Medium 5.9Jwcrypto: jwcrypto: denial of service via malformed jwe tokens0.3%
CVE-2026-81893Medium 4.7Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery0.2%
CVE-2026-78002High 7.5Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function1.1%
CVE-2026-80185Medium 5.7Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root0.3%
CVE-2026-80186High 7.6Bluez: stack overflow in name2utf8 causes dos and potential code execution0.5%
CVE-2026-77680Medium 5.3Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix0.3%
CVE-2026-79992High 7.8Emacs: emacs: command injection via crafted filenames in tramp0.2%
CVE-2026-79655High 7.8Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write0.2%
CVE-2026-78701Medium 6.5389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos0.8%
CVE-2026-19685High 7.1Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)0.2%
CVE-2026-78367High 7.0Rpm: rpmbuild gettarspec() crafted tar member name → macro injection0.2%
CVE-2026-78323Medium 6.5Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates0.2%
CVE-2026-73199Medium 6.5Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value0.4%
CVE-2026-11861Critical 9.6Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships0.4%
CVE-2026-73198High 7.5Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read0.5%
CVE-2026-13097High 8.7Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore0.8%
CVE-2026-73196Medium 4.3Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding0.4%
CVE-2026-73197High 7.5Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read0.6%
CVE-2026-18917High 7.8Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow0.2%
CVE-2026-77014Medium 5.3Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses0.2%
CVE-2026-43961High 7.8Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution0.2%
CVE-2026-76235High 7.5Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html0.6%
CVE-2026-75900Medium 6.1Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch0.1%
CVE-2026-75032Medium 6.3Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder0.2%