Red Hat Red Hat Enterprise Linux 6

• CVE-2026-104030 Medium 5.5 Sssd: sssd: denial of service via out-of-bounds read during passkey parsing 0.1%
• CVE-2026-104988 High 8.1 Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject 0.2%
• CVE-2026-95512 Medium 5.5 Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader 0.2%
• CVE-2026-86345 Critical 9.0 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result 0.4%
• CVE-2026-86344 High 7.5 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue 0.3%
• CVE-2026-103641 Medium 5.5 Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder 0.1%
• CVE-2026-103399 Medium 5.3 Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body 0.2%
• CVE-2026-103242 High 7.1 Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag 0.1%
• CVE-2026-102560 High 8.6 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth 0.5%
• CVE-2026-102559 High 8.6 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking 0.6%
• CVE-2026-102558 High 8.6 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth 0.6%
• CVE-2026-102555 High 8.2 Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding 0.5%
• CVE-2026-102557 High 8.6 Libsoup: libsoup: heap buffer overflow during websocket message reassembly 0.5%
• CVE-2026-102556 High 8.6 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion 0.5%
• CVE-2026-95520 High 7.1 Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages 0.1%
• CVE-2026-102474 Medium 4.0 Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation 0.1%
• CVE-2026-102473 Medium 5.5 Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled 0.1%
• CVE-2026-102010 High 7.0 Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if 0.3%
• CVE-2026-93834 High 8.8 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape 0.4%
• CVE-2026-95521 High 7.8 Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm 0.6%
• CVE-2026-95519 High 7.8 Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) 0.1%
• CVE-2026-97185 High 7.8 Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file 0.1%
• CVE-2026-96889 High 7.8 Librsvg: use-after-free when xml includes have duplicated entities 0.6%
• CVE-2026-96546 Low 2.5 Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader 0.2%
• CVE-2026-96545 Medium 4.4 Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader 0.2%
• CVE-2026-96442 High 7.8 Emacs: emacs: arbitrary code execution in flymake mode 0.2%
• CVE-2026-90462 Medium 5.4 Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization 0.2%
• CVE-2026-94640 High 7.5 Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service 0.6%
• CVE-2026-95619 High 7.7 Gcc: libstdc++ integer overflow in `new` operator 0.4%
• CVE-2026-92382 Medium 4.1 Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write 0.1%
• CVE-2026-94184 Medium 5.3 Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) 1.2%
• CVE-2026-80110 High 8.1 Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint 0.2%
• CVE-2026-75883 Medium 6.8 Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service. 0.3%
• CVE-2026-93653 Medium 5.5 Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) 0.2%
• CVE-2026-81627 High 8.2 Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram 0.2%
• CVE-2026-76781 Medium 5.5 Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute 0.2%
• CVE-2026-92248 High 7.8 Gimp: integer overflow when generating a thumbnail preview for a psd file 0.2%
• CVE-2026-85234 High 7.5 Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine 0.5%
• CVE-2026-85013 High 7.3 Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters 0.2%
• CVE-2026-19816 High 7.1 PackageKit: dnf5 backend ignores SIMULATE on RepoRemove 0.1%
• CVE-2026-90996 Medium 4.0 Sssd: sssd: denial of service in nss responder via crafted zero-length requests 0.1%
• CVE-2026-90995 Medium 5.5 Sssd: sssd: local denial of service due to null pointer dereference in pam responder 0.1%
• CVE-2026-90994 Medium 4.0 Sssd: sssd: denial of service via malformed pam v1 requests 0.2%
• CVE-2026-90463 Medium 4.0 Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`) 0.1%
• CVE-2026-90947 High 7.8 Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file 0.1%
• CVE-2026-90949 High 7.8 Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch 0.3%
• CVE-2026-90948 High 7.8 Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions 0.2%
• CVE-2026-89329 Medium 6.2 Device-mapper-multipath: local denial of service via blocking ipc send operations 0.2%
• CVE-2026-18495 Medium 6.1 Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough 0.1%
• CVE-2026-77159 Medium 5.5 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink 0.2%