TI-2026-41775 CVE-2026-58014 · GHSA-h88q-m8mm-7243
Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
Priority HIGH 76
A flaw was found in GLib.
RHSA-2026:73929
Red Hat AI Inference Server 3.2.2 (cuda)
Released 2026-09-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
Fixes 39 records
TI-2026-41772 CVE-2026-58011 · GHSA-8xmh-8wfg-9f6j
Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime
Priority HIGH 72
A flaw was found in GLib.
TI-2026-06360 CVE-2026-7246
[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
Priority HIGH 67
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project.
TI-2026-13488 CVE-2026-16118 · GHSA-cp7g-r78m-cc2g
Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c
Priority MEDIUM 64
A flaw was found in xdgmime.
TI-2026-41916 CVE-2026-58203
Path traversal in pydantic-settings
Priority MEDIUM 57
pydantic-settings provides settings management using Pydantic.
TI-2026-13117 CVE-2026-15588 · GHSA-hrq7-vgh7-p534
Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering
Priority MEDIUM 57
A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib.
TI-2026-45177 CVE-2026-63374 · GHSA-82r6-8w77-94w6
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
Priority MEDIUM 48
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.
TI-2026-42784 CVE-2026-60002 · GHSA-gp5v-jg37-fvg6
Use after free in OpenBSD OpenSSH
Priority MEDIUM 42
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.
TI-2026-41773 CVE-2026-58012 · GHSA-vwg8-37h9-g38g
Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
Priority MEDIUM 42
A flaw was found in GLib.
TI-2026-41771 CVE-2026-58010 · GHSA-m7rp-473c-296x
Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()
Priority MEDIUM 42
A flaw was found in GLib.
TI-2026-10297 CVE-2026-11940 · GHSA-9mc4-rqmq-h467
tarfile extraction filter bypass allows escaping the destination directory
Priority MEDIUM 41
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.
TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Priority MEDIUM 40
urllib3 is an HTTP client library for Python.
TI-2026-28022 CVE-2026-37237 · GHSA-63mw-rppr-f2pf
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via…
Priority MEDIUM 40
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion.
Priority LOW 39
Vim is an open source, command line text editor.
TI-2026-41435 CVE-2026-57585
MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
Priority LOW 39
MessagePack is the serializer implementation for Python msgpack.org.
Priority LOW 38
Vim is an open source, command line text editor.
Priority LOW 38
Vim is an open source, command line text editor.
TI-2026-10207 CVE-2026-11824 · GHSA-8g48-4wfm-7247
SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate
Priority LOW 38
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…
Priority LOW 37
Vim is an open source, command line text editor.
TI-2026-51283 CVE-2026-73076
Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`
Priority LOW 37
Vim is an open source, command line text editor.
Priority LOW 37
Vim is an open source, command line text editor.
TI-2026-41774 CVE-2026-58013 · GHSA-4x46-h598-64qr
Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
Priority LOW 37
A flaw was found in GLib.
Priority LOW 37
Vim is an open source, command line text editor.
TI-2026-39261 CVE-2026-54369 · GHSA-53ch-pxc8-6g72
acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions
Priority LOW 37
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to esc…
TI-2026-32372 CVE-2026-44431 · GHSA-qccp-gfcp-xxvc
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Priority LOW 36
urllib3 is an HTTP client library for Python.
TI-2026-41776 CVE-2026-58015 · GHSA-hmpf-72wc-2r6x
Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
Priority LOW 34
A flaw was found in GLib.
TI-2026-34752 CVE-2026-47162
Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name
Priority LOW 34
Vim is an open source, command line text editor.
Priority LOW 33
Vim is an open source, command line text editor.
TI-2026-48583 CVE-2026-69244 · GHSA-cq5v-8q36-5273
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
Priority LOW 32
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-42695 CVE-2026-59881 · GHSA-mq44-7p77-q5h7
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
Priority LOW 31
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-10205 CVE-2026-11822 · GHSA-6qj8-gw6p-hc5p
SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek
Priority LOW 31
SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.
TI-2026-39287 CVE-2026-54411 · GHSA-56gg-22rq-q53x
Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison
Priority LOW 30
Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacke…
TI-2026-51273 CVE-2026-73066
Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata
Priority LOW 29
Tesseract is an open source OCR engine.
TI-2026-46365 CVE-2026-64847 · GHSA-5p39-cfhj-2xmp
AnyIO process-pool workers can block indefinitely on undrained stderr
Priority LOW 29
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.
TI-2026-48582 CVE-2026-69243 · GHSA-mfx4-hv73-q22v
AIOHTTP: HTTP request smuggling via WebSocket upgrade
Priority LOW 28
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
Priority LOW 26
Vim is an open source, command line text editor.
TI-2026-34757 CVE-2026-47167
Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex
Priority LOW 24
Vim is an open source, command line text editor.
TI-2026-41387 CVE-2026-57455
Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument
Priority LOW 20
Vim is an open source, command line text editor.
TI-2025-05580 CVE-2025-6170 · GHSA-6qrf-r65h-2r77
Libxml2: stack buffer overflow in xmllint interactive shell command handling
Priority LOW 13
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.