🚨 CVE-2026-102703
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
A common access pattern is a batch of Grant Copy operations acting on
adjacent address ranges in the same source or destination page. For
performance reasons, Xen caches details internally to reuse already
validated data. The conditions on when to re-validate the internal data
were not correct in some cases:
- Frame numbers and grant references could wrongly be mixed up. This
is CVE-2026-102703.
- Copying by frame number (rather than grant reference) is permitted
only when operating on the caller's own memory. The check to enforce
this restriction was misplaced. This is CVE-2026-102704.
🎖@cveNotify
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
A common access pattern is a batch of Grant Copy operations acting on
adjacent address ranges in the same source or destination page. For
performance reasons, Xen caches details internally to reuse already
validated data. The conditions on when to re-validate the internal data
were not correct in some cases:
- Frame numbers and grant references could wrongly be mixed up. This
is CVE-2026-102703.
- Copying by frame number (rather than grant reference) is permitted
only when operating on the caller's own memory. The check to enforce
this restriction was misplaced. This is CVE-2026-102704.
🎖@cveNotify
🚨 CVE-2026-102704
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
A common access pattern is a batch of Grant Copy operations acting on
adjacent address ranges in the same source or destination page. For
performance reasons, Xen caches details internally to reuse already
validated data. The conditions on when to re-validate the internal data
were not correct in some cases:
- Frame numbers and grant references could wrongly be mixed up. This
is CVE-2026-102703.
- Copying by frame number (rather than grant reference) is permitted
only when operating on the caller's own memory. The check to enforce
this restriction was misplaced. This is CVE-2026-102704.
🎖@cveNotify
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
A common access pattern is a batch of Grant Copy operations acting on
adjacent address ranges in the same source or destination page. For
performance reasons, Xen caches details internally to reuse already
validated data. The conditions on when to re-validate the internal data
were not correct in some cases:
- Frame numbers and grant references could wrongly be mixed up. This
is CVE-2026-102703.
- Copying by frame number (rather than grant reference) is permitted
only when operating on the caller's own memory. The check to enforce
this restriction was misplaced. This is CVE-2026-102704.
🎖@cveNotify
🚨 CVE-2026-6842
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
🎖@cveNotify
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
🎖@cveNotify
Redhat
CVE-2026-6842 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-59842
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.
🎖@cveNotify
A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.
🎖@cveNotify
🚨 CVE-2026-59849
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
🎖@cveNotify
A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.
🎖@cveNotify
🚨 CVE-2026-66338
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.
🎖@cveNotify
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.
🎖@cveNotify
Redhat
CVE-2026-66338 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-68744
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
🎖@cveNotify
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
🎖@cveNotify
Redhat
CVE-2026-68744 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-54876
Issue summary: A malicious TLS server can cause a memory leak in a TLS
client that has enabled OCSP response checking by sending an OCSP
response that contains no single response entries.
Impact summary: An attacker can leak an attacker-tunable amount of memory
per TLS handshake in a victim client application. A long-running client
that repeatedly connects to a malicious server can have its memory
exhausted, resulting in a Denial of Service.
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Description: The affected function is called during X.509 certificate
chain verification when OCSP response checking is enabled
with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL
verification flags, for example when a TLS client verifies an OCSP
response stapled into the TLS handshake by the server.
When the received BasicOCSPResponse contains an empty SEQUENCE OF
SingleResponse, which is permitted on the wire and accepted by the
OpenSSL decoder, the OCSP_BASICRESP structure allocated by
OCSP_response_get1_basic() was not freed because an early return
bypassed the cleanup code at the end of the function.
The amount of memory leaked per handshake can be amplified by the
attacker by padding the certs field of the BasicOCSPResponse with
bogus certificates, which are parsed and stored in the leaked
structure before the empty response check triggers the early return.
A long-running TLS client that repeatedly connects to a malicious
server can have its memory exhausted over time.
OCSP response checking is not enabled by default. Only client
applications that explicitly enable the OCSP response check
verification flags are affected.
FIPS impact: no
The FIPS modules in 4.0 and 3.6 are not affected by this issue as the
affected code is outside the OpenSSL FIPS module boundary.
🎖@cveNotify
Issue summary: A malicious TLS server can cause a memory leak in a TLS
client that has enabled OCSP response checking by sending an OCSP
response that contains no single response entries.
Impact summary: An attacker can leak an attacker-tunable amount of memory
per TLS handshake in a victim client application. A long-running client
that repeatedly connects to a malicious server can have its memory
exhausted, resulting in a Denial of Service.
CWE: CWE-401: Missing Release of Memory after Effective Lifetime
Description: The affected function is called during X.509 certificate
chain verification when OCSP response checking is enabled
with the X509_V_FLAG_OCSP_RESP_CHECK or X509_V_FLAG_OCSP_RESP_CHECK_ALL
verification flags, for example when a TLS client verifies an OCSP
response stapled into the TLS handshake by the server.
When the received BasicOCSPResponse contains an empty SEQUENCE OF
SingleResponse, which is permitted on the wire and accepted by the
OpenSSL decoder, the OCSP_BASICRESP structure allocated by
OCSP_response_get1_basic() was not freed because an early return
bypassed the cleanup code at the end of the function.
The amount of memory leaked per handshake can be amplified by the
attacker by padding the certs field of the BasicOCSPResponse with
bogus certificates, which are parsed and stored in the leaked
structure before the empty response check triggers the early return.
A long-running TLS client that repeatedly connects to a malicious
server can have its memory exhausted over time.
OCSP response checking is not enabled by default. Only client
applications that explicitly enable the OCSP response check
verification flags are affected.
FIPS impact: no
The FIPS modules in 4.0 and 3.6 are not affected by this issue as the
affected code is outside the OpenSSL FIPS module boundary.
🎖@cveNotify
GitHub
x509: fix OCSP BasicResponse leak in in-verify check · openssl/openssl@155b5fe
In check_cert_ocsp_resp(), OCSP_response_get1_basic() returns an owning
OCSP_BASICRESP. The combined-condition early return on
OCSP_resp_count(bs) < 1 bypassed the end: cleanup label, leakin...
OCSP_BASICRESP. The combined-condition early return on
OCSP_resp_count(bs) < 1 bypassed the end: cleanup label, leakin...
🚨 CVE-2026-65941
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.
🎖@cveNotify
In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.
🎖@cveNotify
Progress
WhatsUp Gold Security Bulletin August 2026 - Progress Community
Critical Security Alert Bulletin – August 2026 – (CVE-2026-65937, CVE-2026-65938, CVE-2026-65939, CVE-2026-65940, CVE-2026-65941)
🚨 CVE-2026-86564
A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.
🎖@cveNotify
A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.
🎖@cveNotify
Redhat
CVE-2026-86564 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-87876
Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.
🎖@cveNotify
Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.
🎖@cveNotify
🚨 CVE-2026-90463
A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.
🎖@cveNotify
A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.
🎖@cveNotify
Redhat
CVE-2026-90463 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-89020
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership. On older RouterOS versions, this overflow is not limited to crashing the process: the deterministic overwrite of saved registers is exploitable to achieve persistent privilege escalation on the device. On versions with intact exploit mitigations, the impact is limited to a crash of the mtget worker process.
🎖@cveNotify
MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes. Attackers can trigger the overflow by issuing a fetch command with a crafted tftp:// URL path, which causes an unbounded rep movsb instruction to overwrite saved registers at a deterministic offset, crashing the process without requiring a reachable TFTP server or elevated privileges beyond read-only group membership. On older RouterOS versions, this overflow is not limited to crashing the process: the deterministic overwrite of saved registers is exploitable to achieve persistent privilege escalation on the device. On versions with intact exploit mitigations, the impact is limited to a crash of the mtget worker process.
🎖@cveNotify
MikroTik community forum
6.49.21 [long-term] is released!
Before an upgrade: Remember to make backup/export files before an upgrade and save them on another storage device; Make sure the device will not lose power during upgrade process; Device has enough free storage space for all RouterOS packages to be downloaded.…
🚨 CVE-2026-91926
A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.
🎖@cveNotify
A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service.
🎖@cveNotify
Redhat
CVE-2026-91926 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-79699
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
🎖@cveNotify
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.
🎖@cveNotify
Redhat
CVE-2026-79699 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-91142
A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts.
🎖@cveNotify
A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosure of login records. On 32-bit systems, an integer overflow during session accounting allows the user's login process to read or overwrite the legacy log entries of other accounts.
🎖@cveNotify
Redhat
CVE-2026-91142 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-71463
Notification template Jinja AST whitelist only inspects
static Getattr nodes. Dynamic subscripts (job['job'+'_env'])
and {% if job.id > 100 %} conditional gating bypass both
the AST check and the test-render (stub has small job.id).
At runtime, the gated branch executes and exceptions write
full tracebacks into notification body, which is POSTed
to attacker-controlled webhook URL. Leaks install paths,
Python version, source line numbers.
🎖@cveNotify
Notification template Jinja AST whitelist only inspects
static Getattr nodes. Dynamic subscripts (job['job'+'_env'])
and {% if job.id > 100 %} conditional gating bypass both
the AST check and the test-render (stub has small job.id).
At runtime, the gated branch executes and exceptions write
full tracebacks into notification body, which is POSTed
to attacker-controlled webhook URL. Leaks install paths,
Python version, source line numbers.
🎖@cveNotify
🚨 CVE-2026-71464
LaunchConfigurationBaseSerializer.scm_branch has no
validate_scm_branch() leading-dash check, unlike
Project/JobTemplate/JobLaunch serializers. Schedule and
WFJT Node accept --upload-pack=/bin/id as scm_branch.
Currently blocked at runtime by jobs.py:1502 ValueError
check (defense-in-depth), but the API validation gap
means sole reliance on a task-layer guard. Refactoring
that guard away would promote this to RCE.
🎖@cveNotify
LaunchConfigurationBaseSerializer.scm_branch has no
validate_scm_branch() leading-dash check, unlike
Project/JobTemplate/JobLaunch serializers. Schedule and
WFJT Node accept --upload-pack=/bin/id as scm_branch.
Currently blocked at runtime by jobs.py:1502 ValueError
check (defense-in-depth), but the API validation gap
means sole reliance on a task-layer guard. Refactoring
that guard away would promote this to RCE.
🎖@cveNotify
🚨 CVE-2026-71465
RunAdHocCommand.build_args() appends limit as bare
positional (args.append(limit)) instead of using
args.extend(['-l', limit]) like RunJob. A limit beginning
with - is parsed as an ansible CLI option. Currently
limited to short-circuit flags (--version, --help) since
injected element displaces required pattern positional.
Would escalate if ansible-core ever defaults pattern.
🎖@cveNotify
RunAdHocCommand.build_args() appends limit as bare
positional (args.append(limit)) instead of using
args.extend(['-l', limit]) like RunJob. A limit beginning
with - is parsed as an ansible CLI option. Currently
limited to short-circuit flags (--version, --help) since
injected element displaces required pattern positional.
Would escalate if ansible-core ever defaults pattern.
🎖@cveNotify
🚨 CVE-2026-96546
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated.
🎖@cveNotify
A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated.
🎖@cveNotify
Redhat
CVE-2026-96546 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-96282
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
🎖@cveNotify
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
🎖@cveNotify
Redhat
CVE-2026-96282 - Red Hat Customer Portal
CVE Details App