Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-49795 | high | 7.5 | No | A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a... | 2026-11-04 |
| CVE-2025-49794 | critical | 9.1 | No | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML... | 2026-11-04 |
| CVE-2025-49179 | high | 7.3 | No | A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when comput... | 2026-11-04 |
| CVE-2025-49177 | medium | 6.1 | No | A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client... | 2026-11-04 |
| CVE-2025-49176 | high | 7.3 | No | A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, pote... | 2026-11-04 |
| CVE-2025-49175 | medium | 6.1 | No | A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least o... | 2026-11-04 |
| CVE-2025-48798 | high | 7.3 | No | A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an att... | 2026-11-04 |
| CVE-2025-48797 | high | 7.3 | No | A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted b... | 2026-11-04 |
| CVE-2025-48796 | high | 7.3 | No | A flaw was found in GIMP. The GIMP ani_load_image() function is vulnerable to a stack-based overflow. If a user opens.ANI files, GIMP may be... | 2026-11-04 |
| CVE-2025-3931 | high | 7.8 | No | A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes t... | 2026-11-04 |
| CVE-2025-3891 | high | 7.5 | No | A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of... | 2026-11-04 |
| CVE-2025-3155 | high | 7.4 | No | A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows m... | 2026-11-04 |
| CVE-2025-32908 | high | 7.5 | No | A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path... | 2026-11-04 |
| CVE-2025-32911 | critical | 9.0 | No | A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a... | 2026-11-04 |
| CVE-2025-32913 | high | 7.5 | No | A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference.... | 2026-11-04 |
| CVE-2025-32906 | high | 7.5 | No | A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a m... | 2026-11-04 |
| CVE-2025-2240 | high | 7.5 | No | A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally... | 2026-11-04 |
| CVE-2025-26601 | high | 7.8 | No | A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the oth... | 2026-11-04 |
| CVE-2025-26600 | high | 7.8 | No | A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain... | 2026-11-04 |
| CVE-2025-26599 | high | 7.8 | No | An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate... | 2026-11-04 |