Skip to contentRed Hat Enterprise Linux vulnerabilities
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesCVE-2026-44575Fix available7.5 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Middleware / Proxy bypass through dynamic route parameter injectionCVE-2026-44574Fix available8.1 High
- python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 moreurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APICVE-2026-44432Fix available8.9 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 +11 more +13 moreCockpit: cockpit: arbitrary command execution via crafted links in system logs uiCVE-2026-4802Public exploitFix available8.0 High
- dnsmasq, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreCVE-2026-5172CVE-2026-5172Public exploitFix available7.3 High
- dnsmasq, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreCVE-2026-4892CVE-2026-4892Fix available8.4 High
- dnsmasq, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreCVE-2026-4891CVE-2026-4891Fix available5.3 Medium
- dnsmasq, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreCVE-2026-4890CVE-2026-4890Fix available7.5 High
- shlomif xml::libxml, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreXML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequencesCVE-2026-8177Fix available7.5 High
- libexpat project libexpat, red hat discovery 2, enterprise linux 10 +11 more +13 moreIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows...CVE-2026-45186Fix available2.9 Low
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreDoS attack via DOMNode::C14N()CVE-2026-7263Fix available6.3 Medium
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreGlobal buffer over-read in mb_convert_encoding() with attacker-supplied encodingCVE-2026-6104Fix available6.3 Medium
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreSQL injection in pdo_firebird via NUL bytes in quoted stringsCVE-2025-14179Fix available7.4 High
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 morerxrpc: Also unshare DATA/RESPONSE packets when paged frags are presentCVE-2026-43500Public exploitFix availableEPSS 94.1%7.8 High
- linux, linux kernel, red hat enterprise linux 10 +26 more +28 morenetfilter: flowtable: strictly check for maximum number of actionsCVE-2026-43329Fix available7.8 High
- linux, linux kernel, red hat nvidia for rhel 10 +30 more +32 morexfrm: esp: avoid in-place decrypt on shared skb fragsCVE-2026-43284Public exploitFix availableEPSS 94.2%8.8 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreOther issue in the WebRTC componentCVE-2026-8094Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Thunderbird 150.0.2CVE-2026-80938.1 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreMemory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2CVE-2026-8092Fix available8.1 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreIncorrect boundary conditions in the Audio/Video: Playback componentCVE-2026-8091Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreUse-after-free in the DOM: Networking componentCVE-2026-8090Fix available7.3 High
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreSigned integer overflow in metaphone()CVE-2026-7568Fix available6.3 Medium
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreNULL pointer dereference in SOAP apache:Map decoder with missing <value>CVE-2026-7262Fix available2.9 Low
- php, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreUse-After-Free in SOAP using Apache mapCVE-2026-6722Fix available9.5 Critical
- huggingface diffusers, red hat ai inference server, enterprise linux ai (rhel ai) 3 +2 more +4 moreDiffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom componentsCVE-2026-44513Fix available8.8 High
- academysoftwarefoundation openexr, red hat enterprise linux 10, enterprise linux 10.0 extended update support +7 more +9 moreOpenEXR: Out-of-bounds read in `IDManifest::init()` during prefix expansionCVE-2026-42216Fix available8.8 High
- academysoftwarefoundation openexr, red hat enterprise linux 10, enterprise linux 10.0 extended update support +7 more +9 moreOpenEXR is Vulnerable to Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public APICVE-2026-41142Fix available8.8 High
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config has an Authorization Bypass Through User-Controlled KeyCVE-2026-40981Fix available7.5 High
- spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 moreSpring Cloud Config vulnerable to Path TraversalCVE-2026-40982Public exploitFix available9.1 Critical
- lightningai pytorch lightning, lightning-ai pytorch-lightning, red hat ai inference server +2 more +4 moreCompromise of PyTorch Lightning PyPi Package VersionsCVE-2026-44484Fix available9.3 Critical
- kludex python-multipart, red hat exploit intelligence, openshift lightspeed +11 more +13 morePython-Multipart: Denial of Service via unbounded multipart part headersCVE-2026-42561Fix available7.5 High
- linux, linux kernel, red hat enterprise linux 10 +14 more +16 moretcp: fix potential race in tcp_v6_syn_recv_sock()CVE-2026-43198Fix available9.8 Critical
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 moreprocfs: fix possible double mmput() in do_procmap_query()CVE-2026-43178Fix available7.8 High
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 moreKVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulationCVE-2026-43133Fix available7.9 High
- linux, linux kernel, red hat enterprise linux 10 +11 more +13 moredlm: validate length in dlm_search_rsb_treeCVE-2026-43125Fix available9.8 Critical
- red hat enterprise linux 10, enterprise linux 9 +1 moreKeylime: keylime: security bypass due to hardcoded tpm quote nonceCVE-2026-6420Fix available6.3 Medium
- linux, linux kernel, red hat enterprise linux 10 +12 more +14 morenetfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiryCVE-2026-43114Fix available9.4 Critical
- linux, linux kernel, red hat enterprise linux 10 +24 more +26 morefs/smb/client: fix out-of-bounds read in cifs_sanitize_prepathCVE-2026-43112Fix available8.8 High
- beaugunderson ip-address, red hat confidential compute attestation, cryostat 4 +38 more +40 moreip-address: XSS in Address6 HTML-emitting methodsCVE-2026-42338Fix available5.3 Medium
- redis, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreredis-server RESTORE invalid memory access may allow remote code executionCVE-2026-25243Public exploitFix available7.7 High
- redis, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreredis-server Lua use-after-free may allow remote code executionCVE-2026-23631Public exploitFix available6.1 Medium
- redis, red hat enterprise linux 10, enterprise linux 10.0 extended update support +4 more +6 moreredis-server use-after-free in unblock client flow may allow remote code executionCVE-2026-23479Public exploitFix available7.7 High
- eclipse openj9, red hat enterprise linux 10, enterprise linux 10.0 extended update support +1 more +3 moreRed Hat Security Advisory: java-21-ibm-semeru-certified-jdk security updateCVE-2026-69188.7 High
- apache thrift, red hat ai inference server, build of apache camel 3.33 for quarkus 3.33.2.sp1 +7 more +9 moreApache Thrift: Rust implementation vulnerable to CVE-2020-13949 patternCVE-2026-43868Fix available5.3 Medium
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +24 more +26 moreApache Thrift: TSSLTransportFactory.java hostname verificationCVE-2026-43869Fix available7.3 High
- axios, red hat cryostat 4, gatekeeper 3 +45 more +47 moreAxios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijackingCVE-2026-42264Fix available7.4 High
- Show moreLoading…