openshift/ose-rhel-coreos-9 vulnerabilities
CVEs whose affected-version data names the openshift/ose-rhel-coreos-9 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
165 CVEsRSS
CVE-2026-18839Low· 2.2An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width
An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to c…
CVE-2026-68743Medium· 5.5Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1
A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol …
CVE-2026-68742Medium· 5.5Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr
A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request t…
CVE-2026-16531Medium· 5.3Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet
An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.
CVE-2026-16530Medium· 6.5Pcp: pcp: remote denial of service and information leakage
A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which c…
CVE-2026-16526High· 8.8A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
CVE-2026-16524High· 7.8A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
CVE-2026-16529High· 7.5A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation
A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) …
CVE-2026-16527High· 7.3An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
CVE-2026-18107High· 7.8PoCCriu: criu: container escape via rseq critical section hijack during checkpoint/restore
A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, al…
CVE-2026-16313High· 7.6A flaw was found in sg3_utils
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-suppl…
CVE-2026-15003Medium· 5.6Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service
A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file…
CVE-2026-16730Medium· 5.5A flaw was found in dbus-broker
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open ma…
CVE-2026-6390Medium· 6.8A flaw was found in GNU nano's multi-buffer error message handling
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted.…
CVE-2026-16517Low· 2.9A signed integer overflow vulnerability was found in libarchive's ZIP writer
A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when ZIP encryption is enabled and the entry file size is close to INT64_MAX, the a…
CVE-2026-15813Medium· 6.5Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation
A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly code does not properly validate sequence numbers of incoming payload fragments. An attacker can expl…
CVE-2026-12080High· 7.3PoCA flaw was found in the QEMU Guest Agent (qga)
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic dire…
CVE-2026-48863High· 7.5A flaw was found in libsolv
A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious …
CVE-2026-15028Low· 3.9A flaw was found in libarchive
A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.…
CVE-2026-14476High· 8.0A path traversal flaw was found in SSSD's AD GPO provider
A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write file…
CVE-2026-14474High· 8.8A flaw was found in SSSD's LDAP sudo provider
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subt…
CVE-2026-12610Medium· 6.4Sssd: use-after-free crash in sssd' 'sssd_pam' process
A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory pointer is incorrectly handled. A local attacker could exploit this flaw by manipulating…
CVE-2026-13595Medium· 6.8Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When s…
CVE-2026-12505High· 7.8A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment
A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this…
CVE-2026-10649High· 8.6A flaw was found in Pacemaker
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, …
CVE-2026-42014Medium· 6.6A flaw was found in GnuTLS
A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN f…
CVE-2026-48914Medium· 6.7A flaw was found in QEMU's virtio-blk device
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by su…
CVE-2026-11850Medium· 5.0Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read
An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv…
CVE-2026-5419Low· 3.7A flaw was found in gnutls
A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through ob…
CVE-2026-4480Critical· 9.0PoCSamba: samba: remote code execution in printing subsystem via unescaped job description
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta charac…