AISLE CVE Discoveries

MLS X.509 credential not bound to the LeafNode signature key

Code Injection via extends: Inheritance Cache

Apache HTTP Server: mod_dav_fs namespace overflow

Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

Pillow: Invalid free in FreeType glyph rendering when a stroker is active

Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer

Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)

Out-of-bounds read/write in bhyve's HDA audio device model via zero-length BDL entries

Race condition and missing resolution validation in bhyve's framebuffer device model

Race condition in bhyve's xHCI device model via guest-modified event ring size and TRBs

Out-of-bounds write in the TIFF CCITT T6 encoder via an undersized output buffer

Out-of-bounds histogram access in HistogramEqualization from non-finite luminance values

Out-of-bounds write in ICC LUT16 conversion via more than four output channels

Out-of-bounds write in the TIFF CCITT T4 encoder via an undersized output buffer

Disclosure of stale pooled memory in the EXR ZIP decoder after a short inflate

Uncontrolled loop on an attacker-declared BigTIFF IFD entry count stalls a decoder thread

Excessive allocation in ICC CLUT parsing from unvalidated channel and grid dimensions

Busy loop on retryable GnuTLS results in VNC TLS I/O handlers leading to denial of service

Heap buffer overflow in VNC TLS peek buffer handling on partial reads

Heap buffer overflow in the DIGEST-MD5 client via quoting-lengthened challenge fields

redirect to SFTP or SCP bypasses host verification

FTP wildcard write callback mixup

never-ending loop via server response omission

IMAP APPEND plus CRLF conversion command injection

leaking host credentials to HTTP proxy

curl_mime_free stack overflow by recursion

HSTS response erases persisted entries

HSTS cache import drops longer-lived child

FTP connection reuse inherits client-certificate

server-set cookie aborts cookie jar load

server-set cookie erases cookie jar

Authorization: Negotiate sent to foreign origin

-J no-clobber guarantee bypassed with 103 early hints

TFTP direction confusion

auto client cert connection reuse mixup

Negotiate credentials sent to redirected origin

stale SigV4 headers sent unintended

password leak in CURLINFO_EFFECTIVE_URL

HBAC authorization bypass via short-username collisions across trusted domains

Access control bypass via early exit from LDAP access rules on an expired-password warning

Memory exhaustion via abandoned IdP pre-authentication requests that are never cleared

Uninitialized pointer dereference in the PAM responder's passkey Kerberos handling

NULL pointer dereference on certificates lacking the SID extension in certificate mapping

Out-of-bounds write in the NFS idmap plugin when copying oversized cached names

Integer underflow in NSS responder packet header parsing causes an out-of-bounds read

Out-of-bounds read in the PAM responder on a zero-length authentication token

Unbounded negative cache growth in the NSS responder leading to memory exhaustion

Integer underflow in autofs responder packet length parsing causes an out-of-bounds read

Memory exhaustion in the KCM responder via repeatedly storing and destroying credentials

Missing authorization check lets unprivileged users force global autofs cache invalidation

Memory exhaustion in the autofs responder via repeated requests on a long-lived connection

Out-of-bounds read when parsing passkey authentication tokens that lack null terminators

Access control bypass for expired accounts with an LDAP shadow expiration value of zero

Query filter injection via unsanitized Entra ID search input discloses directory data

Memory exhaustion via a race between autofs map enumeration and invalidation

Use-after-free of stale GSSAPI connection state on reused PAM responder connections

Use-after-free in a deferred KCM callback during Kerberos ticket renewal

OData filter injection in Entra ID lookups exposes unintended directory objects

Out-of-bounds read from a miscalculated buffer offset in autofs responder request parsing

Heap-based buffer overflow via crafted fat32 filesystem image

Denial of service via heap buffer overflow during fat16 resize

Missing hostname verification for IP-address hosts in the mbedTLS TLS backend

Missing SSH host key verification in the libssh-based sftp protocol handler

Stack exhaustion in av_encryption_init_info_free() via thousands of MP4 pssh boxes

Infinite loop in the DASH demuxer via an empty SegmentTemplate media attribute

Uninitialized memory disclosure in av_dynamic_hdr_plus_to_t35() via HDR10+ metadata

Host file disclosure via file:// URIs in build manifest source downloads

Denial of service via repeated subroutine allocations in cid font loader

Cross-project authorization bypass in schedule and workflow-definition API endpoints

Denial of service via unbounded memory allocation during portmapper response decoding

Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

Integer overflow on an oversized block index in crafted metadata leading to a crash

Heap out-of-bounds write in the linux kernel rpc-over-rdma server reply path...

Code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

Command injection in rpmuncompress via unescaped filenames passed to popen()

Command injection in rpmbuild via unescaped tarball path

Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

Buffer overflow in strfmon and strfmon_l right-justification padding

EUC_JISX0213 decoding may hang on crafted input

SHIFT_JISX0213 decoding may hang on crafted input

Stack-based out-of-bounds write in tdelete during tree rebalancing

One-byte overread in strncasecmp on Power8

AT_SECURE program buffer overflow via $ORIGIN processing

Denial of service via unbounded connection thread spawning

Arbitrary file ownership change via symlink following in privileged paste

Local attacker can hijack file ownership via symlink race

Arbitrary file ownership and permission modification via symlink race condition

Dnial of service in `cockpit-ws` due to url-root handling without a trailing slash

Sensitive data exposure via command-line arguments

Sensitive data exposure of guest credentials via json argument in process list

Information disclosure of rhsm offline token via process arguments

Integer overflow in `do_lastlog()` offset calculation can misaddress `lastlog` entries on ilp32 builds

Excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder

Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering

Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake

Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Denial of service due to out-of-bounds read/write in remap engine

Out-of-bounds read in libXi's XI2 class parser

Out-of-bounds read in libXi's XListInputDevices() class parsing

Out-of-bounds read in libXi's XListInputDevices()

Out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing

Out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes()

Out-of-bounds read in libXi's XQueryDeviceState()

Out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion

OpenSSL pinning bypass

wolfSSL CA-cache hit overrides callback

native CA store conn reuse

domain-scoped PSL domain cookie

secure cookie attribute bypass with tab

OpenSSL provider use-after-free

undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool

undici vulnerable to caching and replay of unsafe HTTP method responses

Command injection in environment-modules bash completion via malicious module names containing shell metacharacters

Missing Authorization via asset-history CSV importer

License Key Exposure via CSV Export

Information Disclosure via Custom Fields

Authorization Bypass via Importer

Out-of-bounds read in libXtst's RECORD reply parser

Denial of service via use-after-free in binary heap erase_if

NULL Pointer Dereference via Fast I/O

Out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser

Out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser

Out-of-bounds read in libX11's byte-oriented codeset parser

phpMyFAQ before 4.1.8 Authorization Bypass via question/create

phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode

Local denial of service via blocking ipc send operations

Denial of service due to null pointer dereference in pam responder

Fail-open in ldap ppolicy access check allows continued authorization

Denial of service in nss responder via crafted zero-length requests

Denial of service via malformed pam v1 requests

OOB read in nss service request parsers

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

Buffer Over-read in Wireshark

Denial of service via stack buffer overflow in scsi vpd page parsing

Denial of service via unsigned underflow in libXpm's write path

toctou symlink race in `g_file_create_replace_destination` fallback path

World-writable temporary child repositories in system-helper cache path

World-readable oci authentication token in system-helper cache path

FFmpeg Heap Buffer Overflow via RIST Protocol Reader

FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer

FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing

FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c

FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c

FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer

ppp(8): missing length validation in mp_SetEnddisc()

ppp(8): missing length validation in LcpDecodeConfig()

ppp(8): incorrect length calculation in mp_Enddisc()

Buffer overflow in libalias RTSP handler

Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Rodauth before 2.47.0 TOTP Code Reuse via Drift Window

Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Rodauth before 2.47.0 Open Redirect via Return-to Path

Authentication Bypass via LDAP

2FA Bypass via Remember-Me Cookie

Remote code execution via crafted mail headers

SSRF in modcss

Uncontrolled Resource Consumption in XmlTreeBuilder

pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check

pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

pac4j-core before 6.5.6 Open Redirect via Backslash Logout

Heap-based Buffer Overflow in Wireshark

NULL Pointer Dereference in Wireshark

Out-of-bounds Write in Wireshark

Stack-based Buffer Overflow in Wireshark

Out-of-bounds write in BLF file parsing

Out-of-bounds Read in Wireshark

Out-of-bounds Read in Wireshark

NULL Pointer Dereference in Wireshark

Use After Free in Wireshark

Use of Uninitialized Variable in Wireshark

Out-of-bounds Read in Wireshark

NULL Pointer Dereference in Wireshark

Out-of-bounds Write in Wireshark

NULL Pointer Dereference in Wireshark

Reachable Assertion in Wireshark

Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Unauthenticated DoS in via unbounded request body read

Unauthenticated DoS in `/ipa/migration/migration.py` via unbounded request body read

Null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

Authenticated DoS in `otptoken-add` via unbounded otp key decoding/re-encoding

Unbounded peer-controlled json parameters enables remote denial of service via resource exhaustion

Unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion

Memory corruption from uncanceled AIO requests in the one-shot AIO error path

IV reuse across chunks in one-shot symmetric cipher operations on large inputs

Infinite wait loop in _kcapi_aio_read_all() when reusing an AIO handle after an error

RabbitMQ: Consecutive topic wildcards cause combinatorial routing work

Inapplicable PUBLISH property disconnects matching subscribers

Descriptor prefix collision in the AMQP 1.0 parser lets stored messages crash consumers

RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

OAuth credential refresh retains revoked runtime tags

Symlink-following chown allows local privilege escalation via pid file path manipulation

PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting

Unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

Privileged file corruption and denial of service via insecure temporary file handling

Integer underflow in iscsiuio ipv4 dhcp parsing

Integer underflow in iscsiuio dhcpv6 parsing

Denial of service in iscsiuio router advertisement parsing

Stack out-of-bounds read in s_vlog() when handling oversized log messages

SOCKS proxy localhost restriction bypass via IPv4-mapped IPv6 and unspecified addresses

Insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

Authorization Bypass via clonetasks Mass Action

Local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

Use-after-free in HTTP/2 stream-dependency handling after curl_easy_reset()

Double free of the GSASL context during SASL authentication cleanup

Password for another .netrc user sent when the URL specifies only a username

Connection reuse ignores changed client certificate and private key TLS options

Known-host key type mismatch silently accepted via the CURLOPT_SSH_KEYFUNCTION callback

Use-after-free when curl_easy_pause() is called from the socket callback

Site-scoped capability check in nf_delete_all_data enables network-wide data deletion

Unauthenticated stored XSS via crafted Repeatable Fieldset submission indexes

Payment total tampering via fail-open get_calc_value() in ListSelect and ListRadio fields

Missing authorization in the submissions-table block exposes form submissions to visitors

Validation bypass via client-controlled field metadata in the AJAX submission handler

Out-of-bounds read and write in the ADX audio decoder via a mid-stream channel layout change

Double free in the NVDEC hardware decoder when no decoder surfaces remain

Stack buffer overflow in the Vulkan HEVC decoder via oversized vps_num_hrd_parameters

Heap buffer overflow in the VobSub subtitle demuxer via excessive distinct stream IDs

Infinite loop in rtp_asf_fix_header() via an undersized ASF chunksize

Out-of-bounds read in the S/PDIF muxer via an oversized DTS core_size value

Privilege escalation to administrator via unvalidated usergroup role assignments

Cross-tenant private SSH key disclosure via taxonomy scoping bypass

Authorization bypass lets host editors retarget lookup value overrides to other hosts

Cross-tenant infrastructure metadata disclosure via unvalidated IDs in taxonomy_scope

Missing Kerberos principal check in the gssapi-keyex path allows login as arbitrary users

Unbounded memory growth in SFTP clients from responses with unknown request IDs

Infinite loop in automatic certificate authentication leading to denial of service

Stack exhaustion via uncontrolled recursion when applying crafted JSON Patch documents

Exponential runtime in cJSON_Compare() on deeply nested JSON, leading to denial of service

Non-atomic JSON Patch application destroys target document members on failed operations

OAuth2 PKCE bypass via unpersisted S256 code_challenge_method during authorization

Argument injection in the APT backend via crafted package names leading to root code execution

Missing connection throttling in the system-mode RDP listener allows unauthenticated DoS

Stack buffer overflow verifying EdDSA PGP signatures with mismatched MPI lengths

Stack buffer overflow in rpcinfo's rpcbdump() when formatting remote version lists

Stack buffer overflow in rpcinfo's rpcbaddrlist() via a malicious rpcbind server

Infinite loop and out-of-bounds read via a zero-length option in IPv6 Router Advertisements

Inverted IP SubjectAltName comparison in the OpenSSL backend skips authenticity checks

Permission check bypass in channelUpdate via all([]) lets anonymous users modify channels

Out-of-bounds read parsing FTP directory listings leaks memory from other transactions

Controller-side file disclosure via tampered Leapp report content during remediation

Insecure permissions on the PostgreSQL data backup archive expose data to local users

XSS via missing escaping in the generic image output layout

NULL pointer dereference in the SSH protocol dissector

Code injection via the mf command

Reachable assertion in HeifContext::get_track() when opening an empty HEIF sequence file

Use-after-free in mod_ldap with per-directory configuration

XSS in mod_proxy_ftp's FTP directory listing generation

Argument injection in the CONNECT engine's curl command line via the table HTTP attribute

Authorization bypass exposes stored routine definitions to role-granted EXECUTE users

Integer overflow in remote message decompression crashes the CIB remote listener

Integer overflow in SplashOutputDev::tilingPatternFill leading to heap buffer overflow

Stack buffer overflow in rrdcached via an oversized CREATE request

Stored XSS in the prescription multi-print view via patient demographic fields

Unbounded memory request in AcquireAlignedMemory leading to out-of-memory condition

Missing check in the DCM decoder allows images with invalid dimensions, causing crashes

NULL pointer dereference during OCSP chain checking with partial-chain verification

Double free in the TLS client when checking a crafted OCSP stapled response

Command injection via crafted DHCP options allows root code execution in the initramfs

Unauthenticated disclosure of the Active Directory default join password via adInfo()

SQL injection during profile field migration via user-supplied profile field data

Double free in parse_def() when parsing nested compound configuration blocks

Out-of-bounds read in sh_disassemble when disassembling crafted SH2A bytecode

Heap buffer overflow in set_reg_n when disassembling crafted SH2A FPU bytecode

SSO enforcement bypass via the API lets SSO users create local password credentials

Use-after-free in gnutls_pkcs11_token_set_pin() with a NULL old PIN

Authentication bypass via NUL character in RSA-PSK usernames

Certificate validation falls back to Common Name checks on an oversized SAN

Heap overread in RSA key exchange with a PKCS#11-backed key via a short premaster secret

Denial of service via duplicate sequence numbers in DTLS packet reordering

NULL pointer dereference in mod_dav_lock via a malicious request

Stack buffer overflow in libcasper via file descriptors exceeding FD_SETSIZE in select()

Privilege widening in cap_net when keys omitted from a new limit default to allow-any

Heap overflow in FUSE_LISTXATTR handling via a non-NUL-terminated attribute list

SQL injection in logical replication via crafted table names at REFRESH PUBLICATION

Integer wraparound undersizes allocations, letting unprivileged users write out of bounds

Unauthenticated deletion of host AES keys and power schedules via clearAES and clearPMTasks

Stored XSS in the Inventory Report via unescaped option labels in selectForm()

Stored XSS in the Host Management page via the unauthenticated inventory endpoint

Stored XSS via unescaped inventory data in buildRow() on the Group Inventory tab

Heap buffer overflow when decompressing page data from crafted .solv files

Stack buffer overflow in the Debian metadata parser via SHA384/SHA512 checksum tags

Heap buffer overflow in repo_add_solv() via negative size values in a crafted .solv file

Unbounded resource allocation in mod_md when processing OCSP response data

NULL pointer dereference in mod_authn_socache in caching forward proxy configurations

Owner-scope role restrictions not enforced on API v2 endpoints, exposing other users' data

Stored XSS in the project selector via unsanitized project names

Command injection in rpmuncompress via an archive's top-level directory name

WORM protection bypass in vfs_worm via rename over a protected file

Cross-site scripting via improper neutralization of input during web page generation

XSS in the multilingual associations component due to missing output escaping

Command injection in the netrw plugin via crafted sftp:// and file:// URLs

Infinite loop in the GnuTLS backend on circular certificate chains leading to denial of service

Memory corruption when processing crafted web content leading to a process crash

Off-by-one stack write in establish_proxy_connection() via a malformed HTTP proxy response