enterprise_linux_appstream_v_9 vulnerabilities
CVEs whose affected-version data names the enterprise_linux_appstream_v_9 package (go, pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
183 CVEsRSS
CVE-2026-81003High· 7.0kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
A flaw was found in the Linux kernel's AF_IUCV (Advanced Program-to-Program Communication over IUCV) network protocol implementation. The `afiucv_hs_rcv()` function, responsible for receiving frames, does not properly filter incoming frame…
CVE-2026-80775High· 7.0PoCkernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
A flaw was found in the Linux kernel. A race condition exists in the `futex_hash_allocate()` function, specifically during the initial allocation of `mm->futex.phash.ref`. This vulnerability can be triggered in scenarios involving nested `…
CVE-2026-80792High· 7.0kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the `ip6_finish_output2()` function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. …
CVE-2026-85509Critical· 9.8⚖ disputedFreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
CVE-2026-85508Critical· 9.8⚖ disputedipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
CVE-2026-85504Critical· 9.8⚖ disputedFreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
CVE-2026-56855Medium· 5.3golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855)
A flaw was found in golang.org/x/crypto/ssh. After a channel has been established, a remote malicious peer could send specially crafted messages. This could lead to a deadlock of the entire connection, resulting in a Denial of Service (DoS…
CVE-2026-84639High· 7.5thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used.
CVE-2026-80714Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bi…
CVE-2025-30156High· 8.9Ceph is an open-source distributed storage platform providing object, block, and file storage
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that us…
CVE-2026-74746Critical· 9.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node …
CVE-2026-80536High· 8.4In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read fo…
In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read fo…
CVE-2026-79020Medium· 4.3⚖ disputedchromium-browser: skia: chromium-browser: skia: Out of bounds read in Skia (CVE-2026-79020)
An out of bounds read flaw was found in the Skia component of the Chromium browser. Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=514017820
CVE-2026-79229Medium· 6.8chromium-browser: angle: Chromium: Information disclosure via uninitialized resource in ANGLE (CVE-2026-79229)
A flaw was found in ANGLE, a component within Chromium. This uninitialized resource vulnerability could allow a remote attacker, who has already compromised the renderer process, to read sensitive memory outside of the security sandbox. Th…
CVE-2026-79270High· 7.4chromium-browser: angle: Chromium-browser: Memory disclosure via uninitialized resource in ANGLE (CVE-2026-79270)
A flaw was found in chromium-browser. A remote attacker could exploit an uninitialized resource vulnerability in ANGLE by crafting a malicious HTML page. This could allow the attacker to read sensitive memory outside of the browser's secur…
CVE-2026-74641High· 7.8In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-…
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd_us428ctls_vm_fault() turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-…
CVE-2026-63385High· 7.7Libevent is an event notification library
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause dow…
CVE-2026-63381Medium· 6.6Libevent is an event notification library
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains fre…
CVE-2026-49825High· 8.2lxml is a library for processing XML and HTML in the Python language
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. cont…
CVE-2026-76919Medium· 6.5wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919)
A flaw was found in Wireshark. A remote attacker could exploit a denial of service vulnerability in the ESS protocol dissector by processing a specially crafted network packet. This could lead to the application crashing, preventing networ…
CVE-2026-76927Medium· 6.5wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927)
A flaw was found in Wireshark. A remote attacker could exploit a vulnerability in the H.245 protocol dissector. By crafting and sending malformed H.245 protocol data, an attacker could cause the Wireshark application to crash when a user p…
CVE-2026-70906High· 7.5Vulnerability in Oracle Java SE (component: 2D)
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to…
CVE-2026-74960High· 8.1⚖ disputedSite isolation issue in the WebExtensions component
Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74959Critical· 9.1⚖ disputedMitigation bypass in the Storage: Cache API component
Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74957High· 8.1⚖ disputedMitigation bypass in the Safe Browsing component
Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74948Medium· 6.5Information disclosure in the Graphics component
Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74945Medium· 6.5PoCInformation disclosure in the Graphics: Text component
Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74934High· 7.5Site isolation issue in the Graphics: CanvasWebGL component
Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-17106High· 7.8PoCgithub.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)
A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by…
CVE-2026-72243High· 8.4In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-re…
In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-re…