Skip to contentRed Hat Enterprise Linux 10 vulnerabilities
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationCVE-2026-33939Fix available7.5 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockCVE-2026-33938Fix available8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type ConfusionCVE-2026-33937Public exploitFix available9.8 Critical
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via malformed http request headersCVE-2026-28369Fix available8.7 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +20 more +22 moreUndertow: undertow: request smuggling via `\r\r\r` as a header block terminatorCVE-2026-28367Fix available8.7 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via inconsistent header parsingCVE-2026-28368Fix available8.7 High
- grafana, red hat enterprise linux 10, enterprise linux 8 +1 more +3 moreRCE on Grafana via sqlExpressionsCVE-2026-27876Public exploitFix available9.1 Critical
- grafana, red hat enterprise linux 10, enterprise linux 8 +1 more +3 moreOpenFeature evaluation API reads input data with no boundsCVE-2026-27880Fix available7.5 High
- grafana, red hat enterprise linux 10, enterprise linux 10.0 extended update support +3 more +5 morePublic dashboards discloses all direct mode datasourcesCVE-2026-27877Fix available6.5 Medium
- firewalld, red hat enterprise linux 10, enterprise linux 10.0 extended update support +6 more +8 moreFirewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorizationCVE-2026-4948Fix available5.5 Medium
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreAttacker can send a specifically crafted message before authentication that causes managesieve to...CVE-2026-27858Fix available7.5 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory...CVE-2026-27857Fix available4.3 Medium
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +4 more +6 moreDoveadm credentials are verified using direct comparison which is susceptible to timing oracle...CVE-2026-27856Fix available7.4 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +4 more +6 moreDovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin....CVE-2026-24031Public exploitFix available7.7 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be...CVE-2025-59032Fix available7.5 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +16 more +18 moreForge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)CVE-2026-33896Fix available7.4 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +16 more +18 moreForge has signature forgery in Ed25519 due to missing S > L checkCVE-2026-33895Fix available7.5 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +22 more +24 moreForge has signature forgery in RSA-PKCS due to ASN.1 extra fieldCVE-2026-33894Fix available7.5 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +17 more +19 moreForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputCVE-2026-33891Fix available7.5 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: denial of service via use-after-free in soupserver during tls handshakeCVE-2026-2436Fix available6.5 Medium
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926Fix available7.5 High
- nodejs node, node.js, red hat enterprise linux 10 +7 more +9 moreA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received...CVE-2026-21710Public exploitFix availableEPSS 25.4%7.5 High
- freedesktop polkit, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePolkit: polkit: denial of service via unbounded input processing through standard inputCVE-2026-4897Fix available5.5 Medium
- squid-cache squid, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreSquid vulnerable to Denial of Service in ICP Request handlingCVE-2026-33526Fix available9.2 Critical
- squid-cache squid, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreSquid has Denial of Service in ICP Response handlingCVE-2026-32748Fix available8.7 High
- isc kea, red hat enterprise linux 10, enterprise linux 10.0 extended update support +2 moreStack overflow in Kea daemonsCVE-2026-3608Fix available7.5 High
- isc bind, bind 9, red hat enterprise linux 10 +6 more +8 moreMemory leak in code preparing DNSSEC proofs of non-existenceCVE-2026-3104Fix available7.5 High
- isc bind, bind 9, red hat enterprise linux 10 +25 more +27 moreExcessive NSEC3 iterations cause high CPU load during insecure delegation validationCVE-2026-1519Fix available7.5 High
- codehaus-plexus plexus-utils, red hat cryostat 4, openshift developer tools and services +49 more +51 morePlexus-Utils has a Directory Traversal vulnerability in its extractFile methodCVE-2025-67030Fix available8.8 High
- mozilla thunderbird, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreOut of bounds read in IMAP parsingCVE-2026-4371Fix available7.4 High
- libtiff, debian linux, red hat ai inference server 3.2 +30 more +32 moreLibtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processingCVE-2026-4775Fix available7.8 High
- f5 nginx open source, nginx plus, red hat enterprise linux 10 +9 more +11 moreNGINX ngx_mail_auth_http_module vulnerabilityCVE-2026-27651Fix available8.7 High
- f5 nginx open source, nginx plus, red hat enterprise linux 10 +9 more +11 moreNGINX ngx_http_dav_module vulnerabilityCVE-2026-27654Public exploitFix availableEPSS 26.5%8.8 High
- f5 nginx open source, nginx plus, red hat enterprise linux 10 +10 more +12 moreNGINX ngx_http_mp4_module vulnerabilityCVE-2026-32647Fix available8.5 High
- f5 nginx open source, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreNGINX ngx_http_mp4_module vulnerabilityCVE-2026-27784Fix available8.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Firefox 149 and Thunderbird 149CVE-2026-47299.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149CVE-2026-4721Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149CVE-2026-4720Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMitigation bypass in the Networking: HTTP componentCVE-2026-4700Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Layout: Text and Fonts componentCVE-2026-4699Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreJIT miscompilation in the JavaScript Engine: JIT componentCVE-2026-4698Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Audio/Video: Web Codecs componentCVE-2026-4697Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the Layout: Text and Fonts componentCVE-2026-4696Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Audio/Video: Web Codecs componentCVE-2026-4695Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions, integer overflow in the Graphics componentCVE-2026-4694Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Audio/Video: Playback componentCVE-2026-4693Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape in the Responsive Design Mode componentCVE-2026-4692Public exploitFix available10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the CSS Parsing and Computation componentCVE-2026-4691Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM componentCVE-2026-4690Fix available8.6 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM componentCVE-2026-4689Fix available10.0 Critical
- Show moreLoading…