Every CVE Search/ Get API key

CVE-2026-16530

Pcp: pcp: remote denial of service and information leakage

6.5 MediumFix available

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.48%Up 0.2 points since Jul 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Pcp: pcp: remote denial of service and information leakage

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Record
CVE-2026-16530
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-125
Updated
2026-11-05
EUVDEUVD-2026-50978 6.5

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Record
EUVD-2026-50978
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-05
GitHub AdvisoriesGHSA-m276-429x-f63w 6.5

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can...

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Record
GHSA-m276-429x-f63w
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-125
Updated
2026-11-02
NVD 6.5

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Record
CVE-2026-16530
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-125
Updated
2026-11-05
OSVDEBIAN-CVE-2026-16530 6.5

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Record
DEBIAN-CVE-2026-16530
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-3808 8.8

pcp security update

Performance Co-Pilot (PCP) provides a framework and services to support system-level performance monitoring and performance management.

Security Fix(es):

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.(CVE-2026-16524)

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.(CVE-2026-16526)

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.(CVE-2026-16527)

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.(CVE-2026-16529)

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.(CVE-2026-16530)

Record
OESA-2026-3808
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 14 moreShow less
OSVOESA-2026-3809 8.8

pcp security update

Performance Co-Pilot (PCP) provides a framework and services to support system-level performance monitoring and performance management.

Security Fix(es):

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.(CVE-2026-16524)

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.(CVE-2026-16526)

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.(CVE-2026-16527)

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.(CVE-2026-16529)

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.(CVE-2026-16530)

Record
OESA-2026-3809
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-3942 8.8

pcp security update

Performance Co-Pilot (PCP) provides a framework and services to support system-level performance monitoring and performance management.

Security Fix(es):

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.(CVE-2026-16524)

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.(CVE-2026-16526)

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.(CVE-2026-16527)

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.(CVE-2026-16529)

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.(CVE-2026-16530)

Record
OESA-2026-3942
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-16530 6.5

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Record
UBUNTU-CVE-2026-16530
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVAZL-94386 No score

CVE-2026-16530 affecting package pcp 6.3.2-1

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Record
AZL-94386
Updated
2026-11-05
OSVopenSUSE-SU-2026:11490-1 No score

libpcp-devel-6.3.8-3.1 on GA media

These are all security issues fixed in the libpcp-devel-6.3.8-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11490-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21636-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
openSUSE-SU-2026:21636-1
Updated
2026-11-02
OSVSUSE-SU-2026:23064-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:23064-1
Updated
2026-11-02
OSVSUSE-SU-2026:23174-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:23174-1
Updated
2026-11-02
OSVSUSE-SU-2026:23277-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:23277-1
Updated
2026-11-02
OSVSUSE-SU-2026:23316-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:23316-1
Updated
2026-11-02
OSVSUSE-SU-2026:3505-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • Command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • Command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:3505-1
Updated
2026-11-02
OSVSUSE-SU-2026:3506-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:3506-1
Updated
2026-11-02
OSVSUSE-SU-2026:3507-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:3507-1
Updated
2026-11-02
OSVSUSE-SU-2026:3508-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:3508-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pcp
Azure Linux:3
 through 6.3.2-1 None known
pcp
Debian:12
 All versions, plus listed versions
6.0.3-1.16.0.5-16.1.0-16.1.1-16.2.0-1
Show 27 moreShow less
6.2.0-1.16.2.0-1.1~exp16.2.1-16.2.2-16.3.0-16.3.1-16.3.3-16.3.4-16.3.5-16.3.6-16.3.7-16.3.8-17.0.0-17.0.1-17.0.2-17.0.3-17.0.4-17.0.5-17.1.0-17.1.1-17.1.2-17.1.3-27.1.4-17.1.5-17.2.0-17.2.1-27.2.2-1
 None known
pcp
Debian:13
 All versions, plus listed versions
6.3.8-17.0.0-17.0.1-17.0.2-17.0.3-1
Show 11 moreShow less
7.0.4-17.0.5-17.1.0-17.1.1-17.1.2-17.1.3-27.1.4-17.1.5-17.2.0-17.2.1-27.2.2-1
 None known
pcp
Debian:14
 before 7.2.1-2, plus listed versions
6.3.8-17.0.0-17.0.1-17.0.2-17.0.3-1
Show 9 moreShow less
7.0.4-17.0.5-17.1.0-17.1.1-17.1.2-17.1.3-27.1.4-17.1.5-17.2.0-1
7.2.1-2
pcp
openEuler:24.03-LTS-SP1
From an advisory covering 5 CVEs
 before 6.2.2-7.oe2403sp1
6.2.2-7.oe2403sp1
pcp
openEuler:24.03-LTS-SP4
From an advisory covering 5 CVEs
 before 6.2.2-7.oe2403sp4
6.2.2-7.oe2403sp4
pcp
openEuler:24.03-LTS-SP3
From an advisory covering 5 CVEs
 before 6.2.2-7.oe2403sp3
6.2.2-7.oe2403sp3
pcp
SUSE:Linux Micro 6.0
From an advisory covering 6 CVEs
 before 6.2.0-2.1
6.2.0-2.1
pcp
SUSE:Linux Micro 6.1
From an advisory covering 6 CVEs
 before 6.2.0-slfo.1.1_6.1
6.2.0-slfo.1.1_6.1
pcp
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 6.2.0-160000.4.1
6.2.0-160000.4.1
Show 24 moreShow less
Affected packages
PackageAffectedFixed
pcp
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 6.2.0-160000.4.1
6.2.0-160000.4.1
pcp
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 6.2.0-160000.4.1
6.2.0-160000.4.1
pcp
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 6 CVEs
 before 6.2.0-150500.8.9.1
6.2.0-150500.8.9.1
pcp
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150500.8.9.1
6.2.0-150500.8.9.1
pcp
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150500.8.9.1
6.2.0-150500.8.9.1
pcp
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 6 CVEs
 before 6.2.0-150500.8.9.1
6.2.0-150500.8.9.1
pcp
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 6 CVEs
 before 6.2.0-150400.5.15.1
6.2.0-150400.5.15.1
pcp
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150400.5.15.1
6.2.0-150400.5.15.1
pcp
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150400.5.15.1
6.2.0-150400.5.15.1
pcp
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 6 CVEs
 before 6.2.0-150400.5.15.1
6.2.0-150400.5.15.1
pcp
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 6 CVEs
 before 6.2.0-150600.3.12.1
6.2.0-150600.3.12.1
pcp
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150600.3.12.1
6.2.0-150600.3.12.1
pcp
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 6 CVEs
 before 6.2.0-150600.3.12.1
6.2.0-150600.3.12.1
pcp
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-6.32.1
6.2.0-6.32.1
pcp
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 6 CVEs
 before 6.2.0-6.32.1
6.2.0-6.32.1
pcp
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.10.63.10.83.10.8build1
 None known
pcp
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.12.13.12.2-14.0.0-14.0.1-1
 None known
pcp
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.3.4-1build14.3.4-1build25.0.0-15.0.1-15.0.2-1.15.0.2-1.1build15.0.3-1
 None known
pcp
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.3.2-15.3.4-15.3.5-15.3.5-1build15.3.6-1build1
 None known
pcp
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.0.5-16.1.0-16.1.1-16.1.1-1build26.2.0-16.2.0-1.1build36.2.0-1.1build4
 None known
pcp
Ubuntu:26.10
 All versions, plus listed versions
7.1.1-17.1.3-27.1.4-17.1.5-17.2.0-17.2.1-27.2.1-2build1
 None known
pcp
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.3.8-17.0.2-17.1.0-17.1.1-1
 None known
pcp
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 6.3.8-3.1
6.3.8-3.1
pcp
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 6.2.0-160000.4.1
6.2.0-160000.4.1

History

History
RecordedChangedSources
affectedNVD
productsCVE List, EUVD
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-16530 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published July 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 42nd percentile. Fixed in pcp 7.2.1-2.

References

Show 30 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open