fedora

Latest CVEs · RSS

• CVE-2026-103680 2026-10-01 · CVSS 3.1
  A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes for duplicate filen
• CVE-2026-103679 2026-10-01 · CVSS 6.5
  A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulation Format (TNEF) file
• CVE-2026-103678 2026-10-01 · CVSS 5.4
  A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data.
• CVE-2026-103431 2026-10-01 · CVSS 7.7
  colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it,
• CVE-2026-102588 2026-09-30 · CVSS 6.5
  A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an authenticated user with
• CVE-2026-102587 2026-09-30 · CVSS 2.7
  A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges
• CVE-2026-102586 2026-09-30 · CVSS 4.3
  A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting (X
• CVE-2026-102585 2026-09-30 · CVSS 4.3
  A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actu
• CVE-2026-102584 2026-09-30 · CVSS 4.3
  A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without hold
• CVE-2026-102583 2026-09-30 · CVSS 2.7
  A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenti
• CVE-2026-102582 2026-09-30 · CVSS 2.2
  A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with en
• CVE-2026-102581 2026-09-30 · CVSS 4.6
  A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS) vulnerability. An
• CVE-2026-102580 2026-09-30 · CVSS 2.2
  A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary
• CVE-2026-102579 2026-09-30 · CVSS 4.3
  A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other studen
• CVE-2026-102578 2026-09-30 · CVSS 5.5
  A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries,
• CVE-2026-102577 2026-09-30 · CVSS 4.3
  A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user
• CVE-2026-91841 2026-09-25 · CVSS 7.8
  A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline charac
• CVE-2026-91840 2026-09-25 · CVSS 7.8
  A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character in
• CVE-2026-91839 2026-09-25 · CVSS 7.8
  A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-fe
• CVE-2026-91838 2026-09-25 · CVSS 7.8
  A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special c
• CVE-2026-91837 2026-09-25 · CVSS 7.8
  A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserve
• CVE-2026-97222 2026-09-25 · CVSS 5.5
  A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML par
• CVE-2026-19816 2026-09-14 · CVSS 7.1
  A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the
• CVE-2026-19624 2026-09-14 · CVSS 7.8
  A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a gene
• CVE-2026-77652 2026-08-26 · CVSS 7.8
  A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer all