Skip to contentRed Hat Openshift Container Platform vulnerabilities
- xmlsoft libxml2, ibm aix, vios +10 more +12 moreLibxml2: libxml2: denial of service via crafted xsd-validated documentCVE-2026-6732Fix available6.5 Medium
- ruby erb, red hat enterprise linux 10, enterprise linux 10.0 extended update support +10 more +12 moreERB has an @_init deserialization guard bypass via def_module / def_method / def_classCVE-2026-41316Fix available8.1 High
- xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 morexmldom: Denial of service via uncontrolled recursion in XML serializationCVE-2026-41673Fix available8.7 High
- xmldom, red hat build of podman desktop, developer hub 1.8 +6 more +8 morexmldom: XML injection through unvalidated DocumentType serializationCVE-2026-41674Fix available8.7 High
- xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 morexmldom: XML node injection through unvalidated processing instruction serializationCVE-2026-41675Fix available8.7 High
- xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 morexmldom: XML node injection through unvalidated comment serializationCVE-2026-41672Fix available8.7 High
- python-poetry poetry, red hat ansible automation platform 2, ansible automation platform 2.6 +3 more +5 morePoetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4CVE-2026-41140Fix available0.6 Low
- ubuntu libefiboot, red hat enterprise linux 10, enterprise linux 7 +4 more +6 moreEfivar: efivar: denial of service due to stack overflow in device path node parsingCVE-2026-6862Fix available5.5 Medium
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreBinutils: binutils: arbitrary code execution via malformed xcoff object file processingCVE-2026-6846Fix available7.8 High
- gnu binutils, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreBinutils: binutils: denial of service vulnerabilities in readelf via crafted elf filesCVE-2026-6844Fix available5.5 Medium
- gnu nano, red hat enterprise linux 10, enterprise linux 6 +6 more +8 moreNano: nano: format string vulnerability leads to denial of serviceCVE-2026-6843Fix available5.5 Medium
- amazon linux, linux kernel, arista cloudvision agni +142 more +144 morecrypto: algif_aead - Revert to operating out-of-placeCVE-2026-31431In KEVPublic exploitFix availableEPSS 98.1%7.8 High
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreBinutils: binutils: denial of service via crafted elf fileCVE-2026-6845Fix available5.0 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreNano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissionsCVE-2026-6842Fix available2.5 Low
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +21 more +23 moreundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentCVE-2026-9697Fix available7.4 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +19 more +21 moreundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuseCVE-2026-6734Fix available7.5 High
- red hat fast datapath for red hat enterprise linux 10, fast datapath for red hat enterprise linux 8, fast datapath for red hat enterprise linux 9 +3 more +5 moreOvn: ovn: information disclosure via crafted dhcpv6 packetsCVE-2026-53678.6 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreDnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processingCVE-2026-6507Fix available7.5 High
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey OperationsCVE-2026-5807Fix available7.5 High
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault Token Leaked to Backends via Authorization: Bearer Passthrough HeaderCVE-2026-4525Fix available7.5 High
- hashicorp vault, vault enterprise, red hat openshift container platform 4 +1 more +3 moreVault KVv2 Metadata and Secret Deletion Policy Bypass Denial-of-ServiceCVE-2026-3605Fix available8.1 High
- josdejong mathjs, red hat developer hub, enterprise linux 10 +5 more +7 moreMath.js: Unsafe object property setter in mathjsCVE-2026-40897Public exploitFix available8.8 High
- protobufjs project protobufjs, protobufjs protobuf.js, red hat cryostat 4 +20 more +22 moreprotobufjs has an arbitrary code execution issueCVE-2026-41242Public exploitFix available9.4 Critical
- moby spdystream, red hat cert-manager operator for red hat openshift, cluster observability operator 1.5.0 +44 more +46 moreSpdyStream: DOS on CRICVE-2026-35469Fix available8.7 High
- samba rsync, red hat discovery 2, enterprise linux 10 +24 more +26 moreIn rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort...CVE-2026-41035Fix available7.4 High
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +6 more +8 moreSssd: out-of-bounds read in the sssdCVE-2026-6245Fix available5.5 Medium
- containers podman, red hat enterprise linux 10, enterprise linux 8 +3 more +5 morePowerShell Command Injection in Podman HyperV MachineCVE-2026-33414Fix available4.0 Medium
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +24 more +26 morejq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedCVE-2026-40164Fix available7.5 High
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +38 more +40 morejq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted BuffersCVE-2026-39979Fix available6.9 Medium
- red hat fast datapath for rhel 7, fast datapath for rhel 8, fast datapath for rhel 9 +6 more +8 moreOpenvswitch: open vswitch: denial of service via malformed ftp epasv commandCVE-2026-34956Fix available5.9 Medium
- josdejong mathjs, red hat cryostat 4, developer hub +6 more +8 moreUnsafe array index getter in mathjsCVE-2026-41139Fix available8.8 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCVE-2026-40175Public exploitFix available4.8 Medium
- libcap project libcap, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +34 more +36 moreLibcap: libcap: privilege escalation via toctou race condition in cap_set_file()CVE-2026-4878Fix available6.7 Medium
- axios, red hat cluster observability operator 1.5.0, cryostat 4 +60 more +62 moreAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFCVE-2025-62718Fix available6.3 Medium
- hashicorp tooling, red hat openshift container platform 4, trusted artifact signer +1 more +3 moreGo-getter may allow to arbitrary filesystem reads through git operationsCVE-2026-4660Public exploitFix available7.5 High
- patrickjuchli basic-ftp, red hat developer hub 1.8, developer hub 1.9 +3 more +5 moreFTP Command Injection via CRLF in basic-ftpCVE-2026-39983Public exploitFix available8.6 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810Fix available8.2 High
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- go toolchain cmd/go, golang go, red hat openshift service mesh 2 +24 more +26 moreCode execution vulnerability in SWIG code generation in cmd/goCVE-2026-27140Fix available8.8 High
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 moreVite has a `server.fs.deny` bypass with queriesCVE-2026-393648.2 High
- libarchive, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreLibarchive: a null pointer dereference vulnerability exists in the acl parser of libarchiveCVE-2026-5745Fix available5.5 Medium
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +13 more +15 moreVite Affected by Arbitrary File Read via Vite Dev Server WebSocketCVE-2026-39363Public exploitFix available8.2 High
- distribution, red hat multicluster engine for kubernetes, advanced cluster management for kubernetes 2 +7 more +9 moreDistribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidationCVE-2026-35172Fix available7.5 High
- vim, red hat ai inference server 3.2, ai inference server 3.3 +26 more +28 moreVim modeline bypass via various options affects Vim < 9.2.0276CVE-2026-34982Fix available8.2 High
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- sudo project sudo, red hat ai inference server 3.3, enterprise linux 10 +25 more +27 moreIn Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during...CVE-2026-35535Fix available7.4 High
- openbsd openssh, red hat multicluster engine for kubernetes, openshift pipelines +29 more +31 moreIn OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome...CVE-2026-35385Fix available7.5 High
- corosync, red hat enterprise linux 10, enterprise linux 10.0 extended update support +17 more +19 moreCorosync: corosync: denial of service via integer overflow in join message validationCVE-2026-35092Fix available7.5 High
- Show moreLoading…