Hummingbird (Redhat) - vulnerabilities (CVEs)

359 CVEs, 28 in the last 30 days, 1 known versions, newest CVE from 2026-10-22. Vendor: Redhat.

CVEs of Hummingbird

CVE-2026-115207 - CVSS 5.5 (medium), 2026-10-22: A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow…
CVE-2026-114406 - CVSS 6.8 (medium), 2026-10-21: The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of…
CVE-2026-85518 - CVSS 6.1 (medium), 2026-10-21: A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes,…
CVE-2026-114236 - CVSS 3.3 (low), 2026-10-21: storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls…
CVE-2026-92824 - CVSS 6.2 (medium), 2026-10-21: A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound…
CVE-2026-92822 - CVSS 6.2 (medium), 2026-10-21: A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and…
CVE-2026-92823 - CVSS 6.2 (medium), 2026-10-21: A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not…
CVE-2026-16460 - CVSS 7.4 (high), 2026-10-19: A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current…
CVE-2026-17591 - CVSS 3.6 (low), 2026-10-16: A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability,…
CVE-2026-85977 - CVSS 5.3 (medium), 2026-10-16: A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that…
CVE-2026-85231 - CVSS 6.5 (medium), 2026-10-16: A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote…
CVE-2026-88842 - CVSS 3.3 (low), 2026-10-14: A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a…
CVE-2026-88829 - CVSS 7.2 (high), 2026-10-14: A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only…
CVE-2026-90954 - CVSS 7.8 (high), 2026-10-14: A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio,…
CVE-2026-88834 - CVSS 3.7 (low), 2026-10-13: A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build…
CVE-2026-88838 - CVSS 5.5 (medium), 2026-10-13: A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on…
CVE-2026-88833 - CVSS 6.5 (medium), 2026-10-13: A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an…
CVE-2026-108119 - CVSS 6.3 (medium), 2026-10-09: A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate…
CVE-2026-107935 - CVSS 9.3 (critical), 2026-10-09: A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated…
CVE-2026-107655 - CVSS 4 (medium), 2026-10-09: A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an…
CVE-2026-107445 - CVSS 5.4 (medium), 2026-10-08: A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by…
CVE-2026-107444 - CVSS 4.3 (medium), 2026-10-08: A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta…
CVE-2026-107161 - CVSS 7.5 (high), 2026-10-07: A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for…
CVE-2026-106033 - CVSS 5.4 (medium), 2026-10-06: A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect…
CVE-2026-105326 - CVSS 2.5 (low), 2026-10-05: An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription requests that supply a…
CVE-2026-95512 - CVSS 5.5 (medium), 2026-10-02: A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening…
CVE-2026-103242 - CVSS 7.1 (high), 2026-09-30: A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header…
CVE-2026-95520 - CVSS 7.1 (high), 2026-09-29: A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is…
CVE-2026-102010 - CVSS 7 (high), 2026-09-28: A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but…
CVE-2026-95521 - CVSS 7.8 (high), 2026-09-24: A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm…
CVE-2026-95519 - CVSS 7.8 (high), 2026-09-24: A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar…
CVE-2026-88840 - CVSS 5.3 (medium), 2026-09-23: BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.
CVE-2026-88839 - CVSS 6.7 (medium), 2026-09-23: BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.
CVE-2026-88837 - CVSS 6.5 (medium), 2026-09-23: BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
CVE-2026-88835 - CVSS 6.1 (medium), 2026-09-23: BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.
CVE-2026-88831 - CVSS 5.3 (medium), 2026-09-23: BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.
CVE-2026-88832 - CVSS 7.3 (high), 2026-09-23: BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.
CVE-2026-88830 - CVSS 7.5 (high), 2026-09-23: A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted…
CVE-2026-96512 - CVSS 7.8 (high), 2026-09-23: A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone…
CVE-2026-95619 - CVSS 7.7 (high), 2026-09-22: A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability…
CVE-2026-93653 - CVSS 5.5 (medium), 2026-09-18: A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause…
CVE-2026-76781 - CVSS 5.5 (medium), 2026-09-17: A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog…
CVE-2026-92925 - CVSS 7.1 (high), 2026-09-17: A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate…
CVE-2026-42784 - CVSS 7.4 (high), 2026-09-16: A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a…
CVE-2025-11395 - CVSS 5.5 (medium), 2026-09-15: A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the…
CVE-2026-85234 - CVSS 7.5 (high), 2026-09-15: A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can…
CVE-2026-79699 - CVSS 4.4 (medium), 2026-09-15: A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction…
CVE-2026-79705 - CVSS 4.5 (medium), 2026-09-15: A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can…
CVE-2026-85013 - CVSS 7.3 (high), 2026-09-15: A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to…
CVE-2026-18495 - CVSS 6.1 (medium), 2026-09-11: A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted…
CVE-2026-88265 - CVSS 5.6 (medium), 2026-09-10: A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that…
CVE-2026-88264 - CVSS 5.6 (medium), 2026-09-10: A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an…
CVE-2026-84042 - CVSS 7.8 (high), 2026-09-10: A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute…
CVE-2026-87876 - CVSS 3 (low), 2026-09-09: Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and…
CVE-2026-87875 - CVSS 4.3 (medium), 2026-09-09: The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap…
CVE-2026-87766 - CVSS 8.8 (high), 2026-09-09: A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot,…
CVE-2026-74860 - CVSS 8.5 (high), 2026-09-08: A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document…
CVE-2026-86469 - CVSS 5.3 (medium), 2026-09-07: A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails,…
CVE-2026-84838 - CVSS 7.8 (high), 2026-09-02: A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress…
CVE-2026-84837 - CVSS 7.8 (high), 2026-09-02: A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild…
CVE-2026-78410 - CVSS 7.8 (high), 2026-09-02: A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local…
CVE-2026-78409 - CVSS 7 (high), 2026-09-02: The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with…
CVE-2026-78408 - CVSS 7.9 (high), 2026-09-02: The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes…
CVE-2026-84233 - CVSS 7 (high), 2026-09-01: A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow…
CVE-2026-18743 - CVSS 2.5 (low), 2026-09-01: A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to…
CVE-2026-13732 - CVSS 7 (high), 2026-08-31: A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code…
CVE-2026-82327 - CVSS 5.5 (medium), 2026-08-28: A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache…
CVE-2026-19685 - CVSS 9.8 (critical), 2026-08-24: NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix…
CVE-2026-78367 - CVSS 7 (high), 2026-08-24: A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc…
CVE-2026-43961 - CVSS 7.8 (high), 2026-08-19: A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during…
CVE-2026-19617 - CVSS 5.5 (medium), 2026-08-14: A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This…
CVE-2026-19730 - CVSS 4.2 (medium), 2026-08-13: The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy…
CVE-2026-19548 - CVSS 5.5 (medium), 2026-08-12: Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The…
CVE-2026-72693 - CVSS 7.8 (high), 2026-08-11: `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented…
CVE-2026-15816 - CVSS 7.5 (high), 2026-08-07: A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without…
CVE-2026-18938 - CVSS 6.2 (medium), 2026-08-07: A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By…
CVE-2026-19079 - CVSS 4.4 (medium), 2026-08-07: A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or…
CVE-2026-18839 - CVSS 2.2 (low), 2026-08-05: An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an…
CVE-2026-44605 - CVSS 5.5 (medium), 2026-08-05: A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted…
CVE-2026-71227 - CVSS 5.1 (medium), 2026-08-05: A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled…
CVE-2026-71226 - CVSS 7.3 (high), 2026-08-05: Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing…
CVE-2026-71225 - CVSS 6.5 (medium), 2026-08-05: A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or…
CVE-2026-18739 - CVSS 2.5 (low), 2026-08-04: A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host…
CVE-2026-18477 - CVSS 4.4 (medium), 2026-08-03: A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a…
CVE-2026-18508 - CVSS 4.4 (medium), 2026-08-03: A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level…
CVE-2026-18220 - CVSS 7.8 (high), 2026-07-29: An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps…
CVE-2026-15003 - CVSS 5.6 (medium), 2026-07-27: A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a…
CVE-2026-16730 - CVSS 5.5 (medium), 2026-07-24: A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled…
CVE-2026-16517 - CVSS 2.9 (low), 2026-07-21: A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when…
CVE-2026-59851 - CVSS 8.8 (high), 2026-07-21: A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is…
CVE-2026-59850 - CVSS 7.5 (high), 2026-07-21: A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has…
CVE-2026-59849 - CVSS 7.5 (high), 2026-07-21: A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when…
CVE-2026-59848 - CVSS 5.3 (medium), 2026-07-21: A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded…
CVE-2026-59847 - CVSS 7.5 (high), 2026-07-21: A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an…
CVE-2026-59846 - CVSS 3.9 (low), 2026-07-21: A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables…
CVE-2026-16445 - CVSS 7.5 (high), 2026-07-21: A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a…
CVE-2026-59844 - CVSS 6.5 (medium), 2026-07-21: A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to…
CVE-2026-59845 - CVSS 5.9 (medium), 2026-07-21: A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent…
CVE-2026-59843 - CVSS 6.5 (medium), 2026-07-21: A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop…
CVE-2026-59842 - CVSS 5.3 (medium), 2026-07-21: A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without…