Skip to contentLinuxfoundation vulnerabilities
Products
Show 5 moreShow less
Newest
- linuxfoundation everest, everest everest-core +1 moreEVerest has RemoteStop Bypass via BCB Toggle Session RestartCVE-2026-330155.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has Delayed Authorization Response Bypasses Termination After RemoteStopCVE-2026-330145.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: MQTT Switch-Phases Command Data Race Causing Charger State CorruptioCVE-2026-330098.2 High
- linuxfoundation everest, everest everest-core +1 moreEVerest: Charging Continues When WithdrawAuthorization Is Processed Before TransactionStartedCVE-2026-290445.0 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: ISO15118 session_setup use-after-free can crash EVSE processCVE-2026-278285.5 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest's ISO15118 update_energy_transfer_modes overflow can corrupt EVSE stateCVE-2026-278165.5 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: ISO15118 session_setup payment options overflow can corrupt EVSE stateCVE-2026-278155.5 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest EvseManager phase-switch path has unsynchronized shared-state access race conditionCVE-2026-278144.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has use-after-free in auth timeout timer via race conditionCVE-2026-278135.3 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data raceCVE-2026-260747.0 High
- linuxfoundation everest, everest everest-core +1 moreEVerest: OCPP 1.6 heap corruption caused by lock-free insertion in event_queueCVE-2026-260735.9 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_mapCVE-2026-260724.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑FreeCVE-2026-260714.2 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point CrashCVE-2026-260704.6 Medium
- linuxfoundation everest, everest everest-core +1 moreEVerest has OOB via EVSE ID Indexing Mismatch in OCPP 2.0.1 UpdateAllowedEnergyTransferModesCVE-2026-260087.5 High
- linuxfoundation everest, everest everest-core +1 moreEVerest has stack buffer overflow in ifreq.ifr_name when interface name exceeds IFNAMSIZCVE-2026-239958.4 High
- linuxfoundation everest, everest everest-core +1 moreEVerest's unchecked SLAC payload length causes stack overflow in HomeplugMessage::setup_payloadCVE-2026-227908.8 High
- linuxfoundation everest, everest everest-core +1 moreEVerest has off-by-one stack buffer overflow in IsoMux certificate filename parsingCVE-2026-225938.4 High
- linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation, red hat jboss enterprise application platform 8 +1 more +3 moreOpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code ExecutionCVE-2026-33701Public exploitFix available9.3 Critical
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadCVE-2026-27889Fix available7.5 High
- linuxfoundation nats-serverNATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matchingCVE-2026-33248Fix available4.2 Medium
- linuxfoundation nats-serverNATS: Leafnode connections allow spoofing of Nats-Request-Info identity headersCVE-2026-33246Fix available6.4 Medium
- linuxfoundation nats-serverNATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity SpoofingCVE-2026-33223Fix available6.4 Medium
- linuxfoundation nats-serverNATS JetStream has an authorization bypass through its Management APICVE-2026-33222Fix available4.9 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS is vulnerable to pre-auth DoS through WebSockets client serviceCVE-2026-33219Fix available5.3 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has pre-auth server panic via leafnode handlingCVE-2026-33218Fix available7.5 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS allows MQTT clients to bypass ACL checksCVE-2026-33217Fix available7.1 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has MQTT plaintext password disclosureCVE-2026-33216Fix available8.6 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS Server panic via malicious compression on leafnode portCVE-2026-29785Fix available7.5 High
- linuxfoundation nats-serverNATS is vulnerable to MQTT hijacking via Client IDCVE-2026-33215Fix available6.5 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS credentials are exposed in monitoring port via command-line argvCVE-2026-33247Fix available7.4 High
- linuxfoundation nats-serverNATS: Message tracing can be redirected to arbitrary subjectCVE-2026-33249Fix available4.3 Medium
- harborUse of hard coded credentials in GoHarbor HarborCVE-2026-4404Fix available9.4 Critical
- linuxfoundation pytorchPyTorch pt2 Loading deserializationCVE-2026-4538Fix available4.8 Medium
- linuxfoundation tekton pipelines, tektoncd pipeline, red hat builds for red hat openshift +9 more +11 moreTekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver podCVE-2026-33211Fix available9.6 Critical
- linuxfoundation tekton pipelines, tektoncd pipeline +1 moreTekton Pipelines: Controller can panic when setting long resolver names in TaskRun/PipelineRunCVE-2026-33022Fix available6.5 Medium
- linuxfoundation onnx, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain AttackCVE-2026-28500Fix available8.6 High
- linuxfoundation inspektor gadget, inspektor-gadget +1 moreInspektor Gadget: Tracing Denial of Service via Event FloodingCVE-2026-318904.8 Medium
- @backstage plugin-scaffolder-backend, linuxfoundation backstage\/plugin-scaffolder-backend +1 more@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpointCVE-2026-32237Fix available4.4 Medium
- @backstage plugin-auth-backend, linuxfoundation backstage +1 more@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetchCVE-2026-32236Fix available1.7 Low
- @backstage plugin-auth-backend, linuxfoundation backstage +1 more@backstage/plugin-auth-backend: OAuth redirect URI allowlist bypassCVE-2026-32235Fix available5.9 Medium
- kubewarden kubewarden-controller, linuxfoundation kubewarden +1 morekubewarden-controller cross-namespace data exfiltration via deprecated host callback bindingCVE-2026-29773Fix available4.3 Medium
- linuxfoundation yocto, unisoc (shanghai) technologies co., ltd. udx710 +1 moreIn modem, there is a possible improper input validation. This could lead to remote denial of...CVE-2025-616117.5 High
- backstage, linuxfoundation backstage\/plugin-scaffolder-backend +1 more@backstage/plugin-scaffolder-backend: Potential Session Token Exfiltration via Log Redaction BypassCVE-2026-29184Fix available2.0 Low
- backstage, linuxfoundation backstage\/integration +1 more@backstage/integration: Potential reading of SCM URLs using built in tokenCVE-2026-29185Fix available2.7 Low
- backstage, linuxfoundation backstage plugin-techdocs-node, red hat developer hub 1.8 +2 more +4 more@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code ExecutionCVE-2026-29186Fix available7.7 High
- google android, linuxfoundation yocto, mediatek, inc. mediatek chipset +3 more +5 moreIn preloader, there is a possible read of device unique identifiers due to a logic error. This...CVE-2026-20435Fix available4.6 Medium
- linuxfoundation vitessVitess users with backup storage access can write to arbitrary file paths on restoreCVE-2026-27969Fix available9.3 Critical
- linuxfoundation vitessVitess users with backup storage access can gain unauthorized access to production deployment environmentsCVE-2026-27965Fix available8.4 High
- linuxfoundation nats-servernats-server websockets are vulnerable to pre-auth memory DoSCVE-2026-27571Fix available5.9 Medium
- Show moreLoading…