Skip to contentRed Hat Enterprise Linux vulnerabilities
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 morePppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service.CVE-2026-75883Fix available6.8 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +5 more +7 moreJwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops arrayCVE-2026-92091Fix available5.9 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 morePodman: arbitrary file write when importing oci archiveCVE-2025-11395Fix available5.5 Medium
- gnome gimp, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreGimp: integer overflow when generating a thumbnail preview for a psd fileCVE-2026-92248Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreTftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engineCVE-2026-85234Fix available7.5 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +6 more +8 morePodman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directoryCVE-2026-79699Fix available4.4 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callersCVE-2026-79705Fix available4.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreEnvironment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharactersCVE-2026-85013Fix available7.3 High
- red hat enterprise linux 8Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair entries in ntlm challengeCVE-2026-919263.7 Low
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreGnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer sizeCVE-2026-91786Fix available6.1 Medium
- red hat enterprise linux 8, enterprise linux 9, enterprise linux 9.6 extended update support +1 more +3 moreLeapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable pluginsCVE-2026-75092Fix available7.3 High
- fedora, red hat enterprise linux 10, enterprise linux 6 +3 more +5 morePackageKit: dnf5 backend ignores SIMULATE on RepoRemoveCVE-2026-19816Fix available7.1 High
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: denial of service in nss responder via crafted zero-length requestsCVE-2026-909964.0 Medium
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreSssd: sssd: local denial of service due to null pointer dereference in pam responderCVE-2026-909955.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSssd: sssd: denial of service via malformed pam v1 requestsCVE-2026-909944.0 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)CVE-2026-904634.0 Medium
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +2 more +4 moreGimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset fileCVE-2026-90947Fix available7.8 High
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +1 more +3 moreGimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatchCVE-2026-90949Fix available7.8 High
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +2 more +4 moreGimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensionsCVE-2026-90948Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreDevice-mapper-multipath: local denial of service via blocking ipc send operationsCVE-2026-89329Fix available6.2 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parserCVE-2026-88914Fix available4.4 Medium
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 10.0 extended update support +7 more +9 moreGvfs: gvfs-admin socket ownership race permits local rootCVE-2026-88924Fix available7.0 High
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +1 more +3 moreEvolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restrictionCVE-2026-88859Fix available6.3 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 morePcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --tokenCVE-2026-84828Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreCrun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chownCVE-2026-88265Fix available5.6 Medium
- containers crun, red hat enterprise linux 10, enterprise linux 8 +4 more +6 moreCrun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfsCVE-2026-88264Fix available5.6 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreCrun: crun: rootful krun with passt executes container payload as host rootCVE-2026-84042Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreFreeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted urlCVE-2026-181478.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreCups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)CVE-2026-87876Fix available3.0 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreCups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length boundCVE-2026-87875Fix available4.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSssd: sssd: idp authentication prefix comparison allows cross-user impersonationCVE-2026-87853Fix available7.5 High
- red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +4 more +6 moreDpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handlerCVE-2026-86564Fix available3.3 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle blockCVE-2026-180906.1 Medium
- red hat cert manager support for red hat openshift release 1.20, cost management on-premise 1, enterprise linux 10 +22 more +24 moreLibxml2: double-free/uaf in libxml2 python bindingsCVE-2026-74860Fix available8.5 High
- red hat enterprise linux 8, enterprise linux 9 +1 moreGnome-tweaks: path traversal in theme installerCVE-2026-748596.8 Medium
- red hat certificate system 9, enterprise linux 10, enterprise linux 10.0 extended update support +13 more +15 morePki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)CVE-2026-76561Fix available7.2 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGlib2: toctou symlink race in `g_file_create_replace_destination` fallback pathCVE-2026-864695.3 Medium
- red hat directory server 11, directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8 +13 more +15 more389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editorCVE-2026-19843Public exploitFix available8.4 High
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +19 more +21 more389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary propertyCVE-2026-18922Fix available9.8 Critical
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +20 more +22 more389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_searchCVE-2026-184537.5 High
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +20 more +22 more389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()CVE-2026-183557.5 High
- red hat directory server 11, directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8 +21 more +23 more389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dnCVE-2026-765607.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreFreeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of serviceCVE-2026-796788.1 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreIpa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aciCVE-2026-76578Public exploit9.8 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 morePolkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflowCVE-2026-85498Fix available3.5 Low
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: toctou race condition allows symlink redirectionCVE-2026-769255.8 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 moreLibtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksizeCVE-2026-85769Public exploitFix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body readCVE-2026-85534Fix available5.9 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreCorosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systemsCVE-2026-816666.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +13 more +15 moreCorosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassemblyCVE-2026-81665Fix available7.5 High
- Show moreLoading…