Red Hat Exploit Intelligence vulnerabilities

• red hat exploit intelligence, build of quarkus +1 more Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort CVE-2026-121837 4.3 MediumNovember 6, 2026
• red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +7 more +9 more Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw CVE-2026-107912 7.7 HighNovember 5, 2026
• red hat confidential compute attestation, dpu kit for nvidia, exploit intelligence +18 more +20 more Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers CVE-2026-114236 3.3 LowOctober 21, 2026
• red hat exploit intelligence, build of quarkus 3.27.6.redhat, build of quarkus 3.33.4.redhat +2 more Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations CVE-2026-87744 9.1 CriticalOctober 12, 2026
• red hat exploit intelligence, build of quarkus 3.27.6.redhat, build of quarkus 3.33.4.redhat +2 more Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache CVE-2026-94451 6.5 MediumOctober 12, 2026
• red hat exploit intelligence, build of apache camel 3.33.4.redhat, build of apache camel 4 for quarkus 3 +4 more +6 more Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service CVE-2026-94449 7.5 HighSeptember 21, 2026
• red hat exploit intelligence, build of apache camel 3.33.4.redhat, build of apache camel 4 for quarkus 3 +6 more +8 more Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus CVE-2026-93432 6.1 MediumSeptember 18, 2026
• red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +8 more +10 more Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security CVE-2026-87743 7.5 HighSeptember 18, 2026
• red hat exploit intelligence, build of quarkus 3.27.5.sp2, build of quarkus 3.33.3.sp2 +1 more +3 more Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering CVE-2026-87742 7.5 HighSeptember 17, 2026
• red hat exploit intelligence, build of apicurio registry 3, build of quarkus +4 more +6 more Smallrye-jwt: quarkus-smallrye-jwt: smallrye-jwt: unauthenticated same-origin ssrf via unsanitized jwt kid header in awsalbkeyresolver CVE-2026-81829 5.3 MediumSeptember 17, 2026
• berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 more BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication CVE-2026-12773 Fix available 6.9 MediumJune 21, 2026
• berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 more LiteLLM: Authentication Bypass via Host Header Injection CVE-2026-49468 Public exploitFix available 9.5 CriticalJune 16, 2026
• vllm, red hat exploit intelligence, openshift lightspeed +12 more +14 more vLLM: OpenAI auth bypass CVE-2026-48746 Fix available 9.1 CriticalJune 16, 2026
• nltk, red hat exploit intelligence, openshift lightspeed +4 more +6 more NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read CVE-2026-54293 Fix available 7.5 HighJune 16, 2026
• encode starlette, red hat exploit intelligence, migration toolkit for applications 8 +8 more +10 more Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows CVE-2026-48818 Fix available 7.5 HighJune 15, 2026
• aio-libs aiohttp, red hat exploit intelligence, lightspeed core +27 more +29 more AIOHTTP Vulnerable to Deserialization of Untrusted Data CVE-2026-34993 Fix available 6.4 MediumJune 2, 2026
• pip maintainers pip, red hat exploit intelligence, lightspeed core +34 more +36 more pip can extract console_scripts and gui_scripts outside installation directory CVE-2026-8643 Fix available 4.1 MediumMay 28, 2026
• encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 more Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks CVE-2026-48710 In KEVPublic exploitFix available EPSS 70.3% 6.5 MediumMay 22, 2026
• berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 more LiteLLM < 1.83.10 Privilege Escalation via User Update CVE-2026-47102 Public exploitFix available 8.7 HighMay 21, 2026
• berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 more LiteLLM < 1.83.14 Privilege Escalation via API Key Generation CVE-2026-47101 Public exploitFix available 8.7 HighMay 21, 2026
• docker engine, moby docker engine, docker docker/daemon +20 more +22 more Docker: `PUT /containers/{id}/archive` executes container binary on the host CVE-2026-41567 Public exploitFix available 7.2 HighMay 18, 2026
• io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 more opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation CVE-2026-45292 Fix available 5.3 MediumMay 14, 2026
• python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 more urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVE-2026-44432 Fix available 8.9 HighMay 11, 2026
• masci banks, red hat exploit intelligence, openshift lightspeed +1 more +3 more Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI CVE-2026-44209 Fix available 7.5 HighMay 8, 2026
• kludex python-multipart, red hat exploit intelligence, openshift lightspeed +11 more +13 more Python-Multipart: Denial of Service via unbounded multipart part headers CVE-2026-42561 Fix available 7.5 HighMay 6, 2026
• beaugunderson ip-address, red hat confidential compute attestation, cryostat 4 +38 more +40 more ip-address: XSS in Address6 HTML-emitting methods CVE-2026-42338 Fix available 5.3 MediumMay 5, 2026
• berriai litellm, red hat exploit intelligence, ansible automation platform 2 +5 more +7 more LiteLLM: Authenticated command execution via MCP stdio test endpoints CVE-2026-42271 In KEVPublic exploitFix available EPSS 91.4% 8.7 HighApril 25, 2026
• berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 more LiteLLM: Server-Side Template Injection in /prompts/test endpoint CVE-2026-42203 Public exploitFix available 8.6 HighApril 24, 2026
• pyca pyopenssl, red hat confidential compute attestation, exploit intelligence +37 more +39 more pyOpenSSL DTLS cookie callback buffer overflow CVE-2026-27459 Fix available 7.2 HighMarch 16, 2026