Vulnerabilities

TI-2026-13792 CVE-2026-16529 · GHSA-hm96-wjh8-qqgm

Pcp: pcp: denial of service due to signed integer overflow

LOW 39

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00481 Published 2026-07-30 Partial fix · 7.0.3-5.el10_2, 6.3.7-1.el10_0.1 +8 CWE-190

TI-2026-13791 CVE-2026-16527 · GHSA-cf63-g57m-mc5r

LOW 39

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00591 Published 2026-07-30 Partial fix · 7.0.3-5.el10_2, 6.3.7-1.el10_0.1 +8 CWE-306

TI-2026-13790 CVE-2026-16526 · GHSA-534w-2xfq-h655

MEDIUM 41

A flaw in the PCP linux_sockets module exposes an unsecured internal connection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0057 Published 2026-07-30 Partial fix · 7.0.3-5.el10_2, 6.3.7-1.el10_0.1 +8 CWE-403

TI-2026-13789 CVE-2026-16524 · GHSA-f5qw-jg2q-vf56

LOW 37

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00702 Published 2026-07-30 Partial fix · 7.0.3-5.el10_2, 6.3.7-1.el10_0.1 +8 CWE-78