Skip to contentRed Hat Enterprise Linux 10 vulnerabilities
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreRpm: command injection in rpmuncompress via unescaped filenames passed to popen()CVE-2026-848387.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball pathCVE-2026-84837Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreUtil-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinksCVE-2026-78409Fix available7.0 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirectionCVE-2026-78410Fix available7.8 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authorityCVE-2026-78408Fix available7.9 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreFreeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.htmlCVE-2026-536834.3 Medium
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGvfs: mtp: out-of-bounds read in do_read()CVE-2026-84270Fix available4.3 Medium
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGvfs: afp: heap-based buffer overflow in dsi read pathCVE-2026-84269Fix available6.5 Medium
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGvfs: sftp: uninitialized heap disclosure in read_string()CVE-2026-84267Fix available4.3 Medium
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 10.0 extended update support +13 more +15 moreGvfs: sftp: heap-based buffer overflow in read_reply()CVE-2026-84268Fix available8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreRpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenamesCVE-2026-84233Fix available7.0 High
- red hat certificate system 9, enterprise linux 10, enterprise linux 6 +3 more +5 morePki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hostsCVE-2026-536825.3 Medium
- red hat certificate system 9, enterprise linux 10, enterprise linux 6 +3 more +5 morePki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosureCVE-2026-118736.5 Medium
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreGdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elfCVE-2026-13732Fix available7.0 High
- red hat build of apache camel for spring boot 4, enterprise linux 10, enterprise linux 8 +6 more +8 moreUndertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infiniteCVE-2026-816247.5 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +7 more +9 moreLibsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist dataCVE-2026-82327Fix available5.5 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 9 +2 more +4 moreJwcrypto: jwcrypto: denial of service via malformed jwe tokensCVE-2026-801795.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recoveryCVE-2026-81893Fix available4.7 Medium
- red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4, data grid 8 +13 more +15 moreUndertow-core: undertow: denial of service via websocket permessage-deflate processingCVE-2026-56807.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +13 more +15 moreRsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() functionCVE-2026-78002Fix available7.5 High
- red hat ceph storage 4, ceph storage 6, ceph storage 7 +8 more +10 moreLibtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthroughCVE-2026-18495Fix available6.1 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlinkCVE-2026-77159Fix available5.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreBluez: stack overflow in name2utf8 causes dos and potential code executionCVE-2026-80186Fix available7.6 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreBluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as rootCVE-2026-80185Fix available5.7 Medium
- red hat enterprise linux 10Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fixCVE-2026-77680Public exploitFix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreEmacs: emacs: command injection via crafted filenames in trampCVE-2026-79992Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreSos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file writeCVE-2026-79655Fix available7.8 High
- red hat directory server 11, directory server 12, directory server 13 +6 more +8 more389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dosCVE-2026-787016.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreNetworkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)CVE-2026-19685Fix available7.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpmbuild gettarspec() crafted tar member name → macro injectionCVE-2026-78367Fix available7.0 High
- red hat certificate system 10, certificate system 11, enterprise linux 10 +4 more +6 moreJss: jss: jsstrustmanager does not verify nss trust flags on ca certificatesCVE-2026-78323Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreIpa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request valueCVE-2026-731996.5 Medium
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreFreeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationshipsCVE-2026-118619.6 Critical
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreIpa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body readCVE-2026-731987.5 High
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreIpa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastoreCVE-2026-130978.7 High
- freeipa, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreIpa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encodingCVE-2026-731964.3 Medium
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreIpa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body readCVE-2026-731977.5 High
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: short realloc in poptconfigfiletostringCVE-2026-18743Fix available2.5 Low
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +13 more +15 moreLibvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflowCVE-2026-18917Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreLibsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responsesCVE-2026-77014Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +2 more +4 moreCockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_htmlCVE-2026-76235Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 moreSwtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatchCVE-2026-75900Fix available6.1 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreBluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folderCVE-2026-75032Fix available6.3 Medium
- red hat build of apache camel for spring boot 4, enterprise linux 10, enterprise linux 8 +5 more +7 moreIo.undertow/undertow: undertow: http response header integrity issue due to character truncationCVE-2026-198795.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +7 more +9 moreLibdm: lvm2: libdm: denial of service via uncontrolled recursion in config parserCVE-2026-19617Fix available5.5 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: podman: quadlet install --replace non-truncating write retains removed host-access directivesCVE-2026-19730Fix available4.2 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handlingCVE-2026-735846.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdrCVE-2026-735836.6 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreSblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attackCVE-2026-735856.3 Medium
- red hat enterprise linux 10, enterprise linux 9, redhat enterprise linux +2 moreOpen-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsingCVE-2026-18728Fix available6.5 Medium
- Show moreLoading…