Red Hat

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 7.8HighAug 26, 2026Red Hat Automatic Bug Reporting Tool Privilege escalationCVE-2015-5287Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.Added to KEV Aug 26, 2026Exploited5% likelyExploit codeExploit-DB · Metasploit
• 7.4HighAug 26, 2026Red Hat LibuserCVE-2015-3246Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. Added to KEV Aug 26, 2026Exploited8.5% likelyExploit codeExploit-DB · Metasploit
• 9.8CriticalNov 6, 2018Red Hat JBoss RichFaces Framework Code / command injectionCVE-2018-14667Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.Added to KEV Sep 28, 2023 · 1,786 days after publicationExploited74% likely
• 7.8HighFeb 16, 2022Red Hat Polkit Auth bypass / access controlCVE-2021-3560Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.Added to KEV May 12, 2023 · 450 days after publicationExploited24% likelyExploit codeExploit-DB · Metasploit
• 7.8HighJan 28, 2022Red Hat Polkit Memory corruptionCVE-2021-4034The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.Added to KEV Jun 27, 2022 · 150 days after publicationExploited95% likelyExploit codeExploit-DB · MetasploitDetection
• 3.7LowApr 28, 2010Red Hat JBoss Privilege escalationCVE-2010-0738The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.Added to KEV May 25, 2022 · 4,409 days after publicationExploited75% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 5.9MediumApr 28, 2010Red Hat JBoss Privilege escalationCVE-2010-1428Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.Added to KEV May 25, 2022 · 4,409 days after publicationExploited61% likelyExploit codeMetasploit · NucleiDetection
• 8.8HighAug 4, 2010Red Hat JBoss Seam 2 Code / command injectionCVE-2010-1871JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.Added to KEV Dec 10, 2021 · 4,145 days after publicationExploited83% likelyExploit codeExploit-DB · Metasploit
• 9.8CriticalOct 4, 2017Red Hat JBoss Application Server DeserializationCVE-2017-12149The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.Added to KEV Dec 10, 2021 · 1,527 days after publicationExploited91% likelyExploit codeMetasploit · NucleiDetection

Recent

• 3.5LowOct 29, 2026Red Hat Hardened Images Memory corruptionCVE-2026-85498A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).
• 4.2MediumOct 29, 2026Red Hat Build of KeycloakCVE-2026-118030A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
• 5.4MediumOct 29, 2026Red Hat Build of KeycloakCVE-2026-117859A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component. The issue occurs when an authentication flow is restarted, which incorrectly clears the internal markers used to track PAR consumption while leaving the request active. This allows an attacker to reuse the same authorization request to obtain multiple access tokens, bypassing security requirements for single-use requests.
• 5.3MediumOct 29, 2026Red Hat Build of Keycloak Information disclosureCVE-2026-117688A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credenti
• 5.4MediumOct 29, 2026Red Hat Build of Keycloak Auth bypass / access controlCVE-2026-117627A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.
• 6.5MediumOct 29, 2026Red Hat Directory Server 11 Memory corruptionCVE-2026-117548A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.
• 6.5MediumOct 29, 2026Red Hat JBoss Enterprise Application Platform 7 Auth bypass / access controlCVE-2026-19610A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted.
• 7.4HighOct 29, 2026Red Hat JBoss Enterprise Application Platform 7 DeserializationCVE-2026-15564Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.
• 7.4HighOct 29, 2026Red Hat Fuse 7CVE-2026-114488A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.
• 9.1CriticalOct 28, 2026Red Hat OpenShift AI (RHOAI) Auth bypass / access controlCVE-2026-117574A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from
• –UnscoredOct 26, 2026Red HatADV-cccs-21088ef47dc9Serial number: AV26-1084 Date: October 26, 2026 As of October 20, 2026, Red Hat is affected by vulnerabilities in the following products: Red Hat Enterprise Linux 10 All versions Red Hat Enterprise Linux 6 All versions Red Hat Enterprise Linux 7 All versions Red Hat Enterprise Linux 8 All versions Red Hat Enterprise Linux 9 All versions StreamsHub Console for Apache Kafka Prior to 0.12.10 Prior to 0.14.2 Streams for Apache Kafka 2 All versions Streams for Apache Kafka 3 All versions The Cyber Ce
• 7.1HighOct 23, 2026Red Hat Enterprise Linux 10 Memory corruptionCVE-2026-115486A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.
• 6.3MediumOct 23, 2026Red Hat Enterprise Linux 10 Memory corruptionCVE-2026-115485A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
• 7.6HighOct 23, 2026Red Hat Enterprise Linux 10 Memory corruptionCVE-2026-115484A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
• 3.5LowOct 22, 2026Red Hat Enterprise Linux 10 Information disclosureCVE-2026-115449A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.
• 5.5MediumOct 22, 2026Red Hat OpenShift Container Platform 4 Path traversal / file handlingCVE-2026-115424A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a malicious container image can exploit this vulnerability by embedding links, and a chained file entry, that reference locations outside the intended extraction directory. This allows the attacker to write att
• 5.4MediumOct 22, 2026Red Hat Enterprise Linux 10 Auth bypass / access controlCVE-2026-115221A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name (CN), without confirming actual ownership in the directory service. Consequently, an enrolled host can disrupt services by revoking certificates belonging to other entities.
• 5.5MediumOct 22, 2026Red Hat Enterprise Linux 10 Path traversal / file handlingCVE-2026-115207A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
• 6.8MediumOct 21, 2026Red Hat Enterprise Linux 10 Crypto / certificateCVE-2026-114406The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and
• 6.1MediumOct 21, 2026Red Hat Hardened Images Path traversal / file handlingCVE-2026-85518A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing p
• 4.2MediumOct 21, 2026Red Hat Build of Keycloak Auth bypass / access controlCVE-2026-114438A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.
• 7.2HighOct 21, 2026Red Hat Multicluster Global Hub Privilege escalationCVE-2026-110744A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.
• 3.3LowOct 21, 2026Red Hat Confidential Compute Attestation Denial of serviceCVE-2026-114236storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit
• 6.2MediumOct 21, 2026Red Hat Enterprise Linux 10 Memory corruptionCVE-2026-92824A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
• 5.1MediumOct 21, 2026Red Hat Enterprise Linux 10 Memory corruptionCVE-2026-114038A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).
• 8.8HighOct 20, 2026Red Hat streams for Apache Kafka 2 Auth bypass / access controlCVE-2026-105949Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authenticatio
• 9.9CriticalOct 20, 2026Red Hat StreamsHub Console for Apache Kafka® Privilege escalationCVE-2026-105312A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all
• –UnscoredOct 19, 2026Red HatADV-cccs-39f4265a5aacSerial Number: AV26-1061 Date: October 19, 2026 As of October 19, 2026, Red Hat is affected by vulnerabilities in the following products: Fast Datapath for RHEL 10/8/9 All versions ManageIQ All versions Migration Toolkit for Applications 8 All versions Migration Toolkit for Virtualization All versions OpenShift Service Mesh 3 All versions Red Hat Advanced Cluster Management for Kubernetes 2 All versions Red Hat Ansible Automation Platform 2 All versions Red Hat Ansible Automation Platform Ansibl
• 7.1HighOct 16, 2026Red Hat Enterprise Linux 8 Path traversal / file handlingCVE-2026-84823A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disc
• 7.4HighOct 15, 2026Red Hat Connectivity Link 1.4 Code / command injectionCVE-2026-108334A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s
• 8.5HighOct 15, 2026Red Hat Ansible Automation Platform 2.6 Code / command injectionCVE-2026-92982A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permis
• 8.8HighOct 14, 2026Red Hat OpenShift Container Platform 4.19 Privilege escalationCVE-2026-104795The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. **fork()s** a child process 2. **setns()** into the target container's PID and mount namespaces 3. **fchdir()** back to an orphaned FD pointing at the extractor's own root filesystem (where `/crio.sock` is hostPath-mounted) 4. Calls **only `seteuid(target_uid)`** — changing the effective UID but leaving th
• 7.7HighOct 12, 2026Red Hat OpenShift Container Platform 4.14 SSRFCVE-2026-75888A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.
• 7.7HighOct 8, 2026Red Hat OpenShift Container Platform 4.14 Privilege escalationCVE-2026-93017The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather ser
• 5.4MediumOct 8, 2026Red Hat Hardened Images Auth bypass / access controlCVE-2026-107445A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository information belonging to another organization. The same unscoped lookup is used by the mirror action, which may allow creating a repository in a product the user can edit that is configured with another
• 6.1MediumOct 1, 2026Red Hat OpenShift Container Platform 4.14CVE-2026-83589A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.
• 7.8HighSep 30, 2026Red Hat OpenShift Container Platform 4.16CVE-2026-62146A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.
• 7.1HighSep 29, 2026Red Hat Enterprise Linux 10 Path traversal / file handlingCVE-2026-97024A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root.
• 7.1HighSep 28, 2026Red Hat Enterprise Linux 10 Path traversal / file handlingCVE-2026-97023A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root.
• 7.0HighSep 28, 2026Red Hat Enterprise Linux 8 Memory corruptionCVE-2026-102010A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.
• 7.5HighSep 27, 2026Red Hat Enterprise Linux 10 Memory corruptionCVE-2026-96280The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems.
• 7.5HighSep 23, 2026Red Hat OpenShift Container Platform 4.12 Path traversal / file handlingCVE-2026-75887A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.
• 7.8HighSep 23, 2026Red Hat Enterprise Linux 10 Memory corruptionCVE-2026-96889A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.
• 8.8HighSep 23, 2026Red Hat Enterprise Linux 10 Path traversal / file handlingCVE-2026-96275A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.
• 7.8HighSep 23, 2026Red Hat Enterprise Linux 10 Auth bypass / access controlCVE-2026-96512A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to
• 7.5HighSep 22, 2026Red Hat Enterprise Linux 10 Denial of serviceCVE-2026-94640A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
• 7.7HighSep 22, 2026Red Hat Enterprise Linux 8 Memory corruptionCVE-2026-95619A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.
• 9.3CriticalSep 18, 2026Red Hat OpenShift Container Platform 4.12 SSRFCVE-2026-75885A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of
• 7.1HighSep 17, 2026Red Hat Enterprise Linux 10 Memory corruptionCVE-2026-92925A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).
• 7.8HighSep 17, 2026Red Hat Enterprise Linux 10 Code / command injectionCVE-2026-86320A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.

See every Red Hat entry on the dashboard.

Top products

• Red Hat Enterprise Linux 1043 CVEs in the last year, 1 critical
• Red Hat Hardened Images5 CVEs in the last year
• Red Hat Build of Keycloak5 CVEs in the last year
• Red Hat OpenShift Container Platform 4.144 CVEs in the last year
• Red Hat Enterprise Linux 84 CVEs in the last year
• Red Hat OpenShift Container Platform 4.122 CVEs in the last year, 1 critical
• Red Hat OpenShift Container Platform 42 CVEs in the last year
• Red Hat JBoss Enterprise Application Platform 7.4.252 CVEs in the last year, 1 critical
• Red Hat JBoss Enterprise Application Platform 72 CVEs in the last year
• Red Hat Fuse 72 CVEs in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• oss-security · Oct 26, 2026GNU patch 2.8.1 released, fixes CVE-2026-115207CVE-2026-115207
• CCCS (Canada) · Oct 26, 2026Red Hat security advisory (AV26-1084)ADV-cccs-21088ef47dc9
• CISA · Oct 20, 2026Hitachi Energy RTU500 ProductCVE-2026-6732
• CCCS (Canada) · Oct 19, 2026Red Hat security advisory (AV26-1061)ADV-cccs-39f4265a5aac
• CERT/CC · Oct 14, 2026VU#948176: Multiple TLS Libraries can Bypass Delegation EnforcementCVE-2026-3833
• CERT/CC · Oct 13, 2026VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 ImplementationCVE-2026-3833
• Atlassian · Aug 18, 2026Atlassian Security Bulletin August 18, 2026CVE-2026-0603
• GitLab · Jul 9, 2025GitLab Patch Release: 18.1.2, 18.0.4, 17.11.6CVE-2024-12084CVE-2024-12088
• Synology · Jul 2, 2024Synology-SA-24:08 regreSSHionCVE-2024-6387
• SonicWall PSIRT · Jul 1, 2024CVE-2024-6387: regreSSHion RCE in OpenSSH VulnerabilityCVE-2024-6387
• Synology · Apr 1, 2024Synology-SA-24:06 XZ UtilsCVE-2024-3094