Skip to contentRed Hat Openshift Container Platform vulnerabilities
- corosync, red hat enterprise linux 10, enterprise linux 10.0 extended update support +17 more +19 moreCorosync: corosync: denial of service and information disclosure via crafted udp packetCVE-2026-35091Fix available8.2 High
- xmldom, red hat migration toolkit for applications 8, build of podman desktop +6 more +8 morexmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionCVE-2026-34601Fix available7.5 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- vim, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreVim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in...CVE-2026-34714Fix available9.2 Critical
- libarchive, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +36 more +38 moreLibarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processingCVE-2026-5121Fix available7.5 High
- gitlab, red hat openshift pipelines, openshift container platform 4 +2 moreImproper Handling of Parameters in GitLabCVE-2026-2370Fix available8.1 High
- capricorn86 happy dom, happy-dom, red hat ansible automation platform 2 +1 more +3 moreHappy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiesCVE-2026-34226Fix available7.5 High
- moby, docker engine, red hat multicluster engine for kubernetes +7 more +9 moreMoby: Off-by-one error in plugin privilege validationCVE-2026-33997Fix available6.8 Medium
- firewalld, red hat enterprise linux 10, enterprise linux 10.0 extended update support +6 more +8 moreFirewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorizationCVE-2026-4948Fix available5.5 Medium
- capricorn86 happy-dom, happy dom, red hat ansible automation platform 2 +1 more +3 moreHappy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codeCVE-2026-33943Fix available8.8 High
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926Fix available7.5 High
- freedesktop polkit, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePolkit: polkit: denial of service via unbounded input processing through standard inputCVE-2026-4897Fix available5.5 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadCVE-2026-27889Fix available7.5 High
- isc bind, bind 9, red hat enterprise linux 10 +6 more +8 moreMemory leak in code preparing DNSSEC proofs of non-existenceCVE-2026-3104Fix available7.5 High
- isc bind, bind 9, red hat enterprise linux 10 +25 more +27 moreExcessive NSEC3 iterations cause high CPU load during insecure delegation validationCVE-2026-1519Fix available7.5 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS is vulnerable to pre-auth DoS through WebSockets client serviceCVE-2026-33219Fix available5.3 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has pre-auth server panic via leafnode handlingCVE-2026-33218Fix available7.5 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS allows MQTT clients to bypass ACL checksCVE-2026-33217Fix available7.1 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has MQTT plaintext password disclosureCVE-2026-33216Fix available8.6 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS Server panic via malicious compression on leafnode portCVE-2026-29785Fix available7.5 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS credentials are exposed in monitoring port via command-line argvCVE-2026-33247Fix available7.4 High
- vim, red hat ai inference server 3.2, ai inference server 3.3 +28 more +30 moreVim affected by Command injection via newline in glob()CVE-2026-33412Fix available5.6 Medium
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreBinutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd libraryCVE-2026-4647Fix available6.1 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreQemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob writeCVE-2026-3842Fix available7.8 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Prototype Pollution via parse()CVE-2026-33228Fix available8.9 High
- libarchive, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreLibarchive: libarchive: denial of service via malformed iso file processingCVE-2026-4426Fix available6.5 Medium
- libarchive, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +39 more +41 moreLibarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processingCVE-2026-4424Fix available7.5 High
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical
- nghttp2, red hat jboss core services for rhel 8, jboss core services on rhel 7 +37 more +39 morenghttp2 Denial of service: Assertion failure due to the missing state validationCVE-2026-27135Fix available7.5 High
- pyasn1, red hat migration toolkit for containers, migration toolkit for virtualization +40 more +42 morepyasn1 Vulnerable to Denial of Service via Unbounded RecursionCVE-2026-30922Fix available7.5 High
- github.com/buger/jsonparser, jsonparser project jsonparser, red hat cluster observability operator 1.5.0 +17 more +19 moreDenial of service in github.com/buger/jsonparserCVE-2026-32285Fix available7.5 High
- github.com/jackc/pgproto3/v2, jackc pgproto3, red hat assisted installer for red hat openshift container platform 2 +26 more +28 moreDenial of service in github.com/jackc/pgproto3/v2CVE-2026-32286Public exploitFix available7.5 High
- pyca pyopenssl, red hat confidential compute attestation, exploit intelligence +37 more +39 morepyOpenSSL DTLS cookie callback buffer overflowCVE-2026-27459Fix available7.2 High
- red hat cert manager support for red hat openshift release 1.18, ai inference server 3.2, ai inference server 3.3 +22 more +24 moreLibarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchiveCVE-2026-4111Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +4 more +6 moreSystemd: systemd: privilege escalation via improper access control in registermachine d-bus methodCVE-2026-4105Fix available6.7 Medium
- libssh, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreLibssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windowsCVE-2025-14821Fix available7.8 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Unbounded recursion DoS in parse() revive phaseCVE-2026-32141Fix available7.5 High
- debian linux, openbsd openssh, canonical ubuntu linux +39 more +41 moreVulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This...CVE-2026-3497Fix available2.7 Low
- quinn-rs quinn, red hat confidential compute attestation, logging subsystem for red hat openshift +13 more +15 moreQuinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingCVE-2026-31812Fix available8.7 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 moreIncorrect enforcement of email constraints in crypto/x509CVE-2026-27137Fix available7.5 High
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS ACL BypassCVE-2026-26017Fix available7.7 High
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS Loop Detection Denial of Service VulnerabilityCVE-2026-26018Fix available7.5 High
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreBinutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linkerCVE-2026-3442Fix available6.1 Medium
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreBinutils: gnu binutils: information disclosure via specially crafted xcoff object fileCVE-2026-3441Fix available6.1 Medium
- isaacs node-tar, tar, red hat cryostat 4 +20 more +22 morenode-tar: Hardlink Path Traversal via Drive-Relative LinkpathCVE-2026-29786Public exploitFix available8.2 High
- python-markdown markdown, red hat external secrets operator for red hat openshift, multicluster engine for kubernetes +27 more +29 morePython-Markdown has an Uncaught ExceptionCVE-2025-69534Fix available7.5 High
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 moreSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074Fix available7.5 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- docker compose, cli, command line interface +27 more +29 moreDocker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityCVE-2025-15558Fix available7.0 High
- Show moreLoading…