Skip to contentRed Hat Ceph Storage 6 vulnerabilities
- red hat ceph storage 4, ceph storage 6, ceph storage 7 +8 more +10 moreLibtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthroughCVE-2026-18495Fix available6.1 Medium
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- prometheus, red hat file integrity operator, logging for red hat openshift 6 +53 more +55 morePrometheus: remote read endpoint allows denial of service via crafted snappy payloadCVE-2026-42154Public exploitFix available7.5 High
- prometheus, red hat custom metric autoscaler operator for red hat openshift, file integrity operator +52 more +54 morePrometheus Azure AD remote write OAuth client secret exposed via config APICVE-2026-42151Fix available7.5 High
- apache thrift, red hat multicluster global hub, multicluster global hub 1.3.4 +17 more +19 moreApache Thrift: Go TFramedTransport uint32 overflowCVE-2026-41602Fix available7.5 High
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +16 more +18 moreApache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.CVE-2025-48431Fix available7.5 High
- grafana tempo, enterprise traces (get), red hat logging subsystem for red hat openshift +13 more +15 moreTempo query limit results in unbounded memory allocationCVE-2026-21728Fix available7.5 High
- grafana pyroscope, red hat multicluster global hub, multicluster global hub 1.7.0 +5 more +7 moreSensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protectionCVE-2025-41118Fix available9.1 Critical
- openfga, red hat multicluster global hub 1.7.0, advanced cluster management for kubernetes 2.14 +3 more +5 moreOpenFGA Playground Preshared Key ExposureCVE-2026-40293Fix available6.5 Medium
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +12 more +14 moreDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege EscalationCVE-2026-21721Public exploitFix available8.1 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- ansible-collections ansible community general collection, red hat ceph storage 5, ceph storage 6 +5 more +7 moreAnsible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose outputCVE-2025-14010Fix available5.5 Medium
- red hat builds for red hat openshift, custom metric autoscaler operator for red hat openshift, multicluster global hub +24 more +26 moreGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsCVE-2025-8556Fix available3.7 Low
- openbsd openssh, almalinux, amazon linux +71 more +73 moreOpenssh: regresshion - race condition in ssh allows rce/dosCVE-2024-6387Public exploitFix availableEPSS 99.5%8.1 High
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical