Total
24 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-2625 | 2 Redhat, Sequoia-pgp | 3 Enterprise Linux, Hardened Images, Rpm-sequoia | 2026-05-01 | N/A | 4.0 MEDIUM |
| A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During the RPM signature verification process, this crafted file can trigger an error in the OpenPGP signature parsing code, leading to an unconditional termination of the rpm process. This issue results in an application level denial of service, making the system unable to process RPM files for signature verification. | |||||
| CVE-2026-3184 | 2 Kernel, Redhat | 2 Util-linux, Hardened Images | 2026-05-01 | N/A | 3.7 LOW |
| A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access. | |||||
| CVE-2025-14821 | 2 Libssh, Redhat | 2 Libssh, Hardened Images | 2026-04-29 | N/A | 7.8 HIGH |
| A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation of trusted host information, posing a significant risk to the confidentiality, integrity, and availability of SSH communications via an insecure default configuration on Windows systems where the library automatically loads configuration files from the C:\etc directory, which can be created and modified by unprivileged local users. | |||||
| CVE-2026-5704 | 2 Gnu, Redhat | 3 Tar, Enterprise Linux, Hardened Images | 2026-04-22 | N/A | 5.0 MEDIUM |
| A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. | |||||