Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102557 | high | 8.6 | No | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message... | 2026-11-04 |
| CVE-2026-102556 | high | 8.6 | No | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteA... | 2026-11-04 |
| CVE-2026-102280 | not reported | — | No | Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_... | 2026-11-04 |
| CVE-2026-0719 | high | 8.6 | No | A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network comm... | 2026-11-04 |
| CVE-2026-100236 | high | 8.6 | No | A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in... | 2026-11-04 |
| CVE-2026-101258 | high | 7.8 | No | A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execut... | 2026-11-04 |
| CVE-2026-0603 | high | 8.3 | No | A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing s... | 2026-11-04 |
| CVE-2025-9900 | high | 8.8 | No | A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted... | 2026-11-04 |
| CVE-2025-9784 | high | 7.5 | No | A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This i... | 2026-11-04 |
| CVE-2025-8067 | high | 8.5 | No | A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved vi... | 2026-11-04 |
| CVE-2025-6018 | high | 7.8 | No | A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This... | 2026-11-04 |
| CVE-2025-7425 | high | 7.8 | No | A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT... | 2026-11-04 |
| CVE-2025-7424 | high | 7.5 | No | A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type con... | 2026-11-04 |
| CVE-2025-66287 | high | 8.8 | No | A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. | 2026-11-04 |
| CVE-2025-5914 | high | 7.8 | No | A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This fl... | 2026-11-04 |
| CVE-2025-5791 | high | 7.1 | No | A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or pro... | 2026-11-04 |
| CVE-2025-4404 | critical | 9.1 | No | A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniquen... | 2026-11-04 |
| CVE-2025-49796 | critical | 9.1 | No | A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. Th... | 2026-11-04 |
| CVE-2025-4948 | high | 7.5 | No | A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other ap... | 2026-11-04 |
| CVE-2025-49180 | high | 7.8 | No | A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to a... | 2026-11-04 |