Skip to contentRed Hat Openshift Container Platform vulnerabilities
- red hat confidential compute attestation, ansible automation platform 2, ansible automation platform 2.6 for rhel 9 +12 more +14 moreSequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusionCVE-2026-42784Fix available7.4 High
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +35 more +37 moreGlib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receiveCVE-2026-58015Fix available5.9 Medium
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +38 more +40 moreGlib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"CVE-2026-58014Fix available7.3 High
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreSssd: use-after-free crash in sssd' 'sssd_pam' processCVE-2026-12610Fix available6.4 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +29 more +31 moreLibarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()CVE-2026-14164Fix available7.5 High
- p11-kit project p11-kit, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +16 more +18 moreP11-kit: stack exhaustion via unbounded recursion in rpc attribute parsingCVE-2026-13757Fix available6.2 Medium
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676Fix available7.5 High
- attr project attr, red hat cert manager support for red hat openshift release 1.19, discovery 2 +8 more +10 moreattr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattrCVE-2026-54371Fix available8.4 High
- acl project acl, red hat discovery 2, enterprise linux 10 +11 more +13 moreacl < 2.4.0 Symlink Traversal Privilege Escalation via libacl FunctionsCVE-2026-54369Fix available8.4 High
- kernel util-linux, red hat cost management on-premise 1, enterprise linux 10 +10 more +12 moreUtil-linux: util-linux: heap use-after-free in libblkid nested partition probingCVE-2026-13595Fix available6.8 Medium
- lepture mistune, red hat migration toolkit for applications 8, openshift ai (rhoai) +3 more +5 moreMistune: Potential DoS via quadratic-time parsing in parse_link_textCVE-2026-49851Fix available8.7 High
- thekelleys dnsmasq, red hat enterprise linux 10, enterprise linux 6 +6 more +8 moreDnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validationCVE-2026-12969Fix available5.3 Medium
- openbsd openssh, redhat enterprise linux, red hat enterprise linux 10 +8 more +10 moreOpenssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel terminationCVE-2026-55654Fix available3.7 Low
- openbsd openssh, redhat enterprise linux, red hat enterprise linux 10 +21 more +23 moreOpenssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versionsCVE-2026-55655Fix available5.0 Medium
- openbsd openssh, redhat enterprise linux, red hat enterprise linux 10 +23 more +25 moreOpenssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of serviceCVE-2026-55653Fix available4.3 Medium
- thekelleys dnsmasq, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreDnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey repliesCVE-2026-12725Fix available5.9 Medium
- redhat openshift container platform, windows machine config operator, red hat openshift container platform 4 +4 more +6 moreWindows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theftCVE-2026-541008.3 High
- redhat openshift container platform, windows machine config operator, red hat openshift container platform 4 +5 more +7 moreWindows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:mastersCVE-2026-540998.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +11 more +13 moreDracut: dracut: root code execution via dhcp options command injection in networkmanager initrd moduleCVE-2026-16445Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreCifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcallCVE-2026-12505Fix available7.8 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +25 more +27 moreundici WebSocket client vulnerable to denial of service via fragment count bypassCVE-2026-12151Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +14 more +16 morePacemaker: pacemaker: denial of service via integer overflow in remote message decompressionCVE-2026-10649Fix available8.6 High
- linux, linux kernel, red hat nvidia for rhel 10 +28 more +30 morenet/sched: fix pedit partial COW leading to page cache corruptionCVE-2026-46331Public exploitFix available7.8 High
- websockets ws, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 morews: Memory exhaustion DoS from tiny fragments and data chunksCVE-2026-48779Fix available7.5 High
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreQemu-kvm: heap buffer overflow in virtio-blk scsi request handlingCVE-2026-48914Fix available6.7 Medium
- vim, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreVim: Arbitrary Code Execution via Python Omni-CompletionCVE-2026-52860Fix available7.5 High
- vim, red hat enterprise linux 10, enterprise linux 10.0 extended update support +9 more +11 moreVim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory nameCVE-2026-47162Fix available7.3 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreKrb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds readCVE-2026-11850Fix available5.0 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +23 more +25 moreDracut: dracut: root code execution via dhcp options command injectionCVE-2026-6893Fix available7.5 High
- linux, linux kernel, red hat enterprise linux 10 +20 more +22 morenet: gro: don't merge zcopy skbsCVE-2026-46323Fix available7.8 High
- linux, linux kernel, red hat enterprise linux 10 +12 more +14 moreKVM: arm64: vgic-its: Drop the translation cache reference only for the erased entryCVE-2026-46316Public exploitFix available9.3 Critical
- arm c1-premium, c1-ultra, cortex-a710 +45 more +47 moreArm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1,...CVE-2025-10263Public exploitFix available9.1 Critical
- openssl, red hat cost management 4, multicluster engine for kubernetes +23 more +25 moreHeap Use-After-Free in the PKCS7_verify() FunctionCVE-2026-45447Public exploitFix available8.8 High
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +29 more +31 moreAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionCVE-2026-11332Fix available7.8 High
- openstack ironic, red hat openshift container platform 4, openstack platform 16.2 +2 more +4 moreOpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service CrashCVE-2026-50589Fix available5.3 Medium
- axios, red hat cryostat 4, gatekeeper 3 +62 more +64 moreAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionCVE-2026-44496Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Allocation of Resources Without Limits or Throttling in axiosCVE-2026-44488Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdapterCVE-2026-44487Fix available8.2 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionCVE-2026-44486Fix available7.5 High
- red hat openshift container platform 4, openshift container platform 5 +1 moreCloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on awsCVE-2026-108437.2 High
- red hat multicluster engine for kubernetes, enterprise linux 10, enterprise linux 6 +16 more +18 moreNetworkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backendCVE-2026-10805Fix available6.7 Medium
- red hat openshift container platform 4, openstack platform 16.2, openstack platform 17.1 +1 more +3 moreOpenStack oslo.messaging does not verify RabbitMQ broker hostname during TLS handshakeCVE-2026-44393Fix available7.4 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +7 more +9 moreOse-cluster-ingress-operator: remote code execution through haproxy configuration injectionCVE-2026-17848.8 High
- vitejs launch-editor, vite, red hat cluster observability operator 1.5.0 +25 more +27 morelaunch-editor vulnerable to command injection via the crafted request on WindowsCVE-2024-52011Public exploitFix available7.5 High
- linux, linux kernel, red hat nvidia for rhel 10 +26 more +28 moresmb: client: reject userspace cifs.spnego descriptionsCVE-2026-46243Public exploitFix available7.1 High
- redhat openshift container platform, red hat openshift container platform 4 +1 moreOpenshift: openshift: non-admin user can bypass resourcequota and flood etcd with events causing cluster-wide api degradationCVE-2026-105335.0 Medium
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495Fix available7.0 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`CVE-2026-44494Fix available8.7 High
- Show moreLoading…