Skip to contentRed Hat Enterprise Linux 7 Extended Lifecycle Support vulnerabilities
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: certificate validation bypass due to oversized subject alternative nameCVE-2026-42013Fix available8.2 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +24 more +26 moreGnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sansCVE-2026-42012Fix available7.1 High
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +46 more +48 moreGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityCVE-2026-42009Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreMemory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1CVE-2026-7323Fix available7.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreMemory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1CVE-2026-7322Fix available7.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreInformation disclosure due to incorrect boundary conditions in the Audio/Video componentCVE-2026-7320Fix available7.5 High
- linux, linux kernel, red hat enterprise linux 10 +6 more +8 moreusbip: validate number_of_packets in usbip_pack_ret_submit()CVE-2026-31607Fix available9.8 Critical
- packagekit, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 morePackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as rootCVE-2026-41651Public exploitFix available8.8 High
- oracle graalvm, graalvm for jdk, jdk +33 more +35 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...CVE-2026-22016Public exploitFix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreMemory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150CVE-2026-6786Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreMemory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150CVE-2026-6785Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUse-after-free in the JavaScript Engine componentCVE-2026-6754Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreIncorrect boundary conditions in the WebRTC componentCVE-2026-6753Fix available7.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreIncorrect boundary conditions in the WebRTC componentCVE-2026-6752Fix available7.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUninitialized memory in the Audio/Video: Web Codecs componentCVE-2026-6751Fix available7.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 morePrivilege escalation in the Graphics: WebRender componentCVE-2026-6750Fix available8.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreInformation disclosure due to uninitialized memory in the Graphics: Canvas2D componentCVE-2026-6749Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUninitialized memory in the Audio/Video: Web Codecs componentCVE-2026-6748Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUse-after-free in the WebRTC componentCVE-2026-6747Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +17 more +19 moreUse-after-free in the DOM: Core & HTML componentCVE-2026-6746Fix available7.5 High
- samba rsync, red hat discovery 2, enterprise linux 10 +24 more +26 moreIn rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort...CVE-2026-41035Fix available7.4 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory accessCVE-2026-34003Fix available7.8 High
- x.org x server, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreXorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handlingCVE-2026-34002Fix available6.1 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruptionCVE-2026-34001Fix available7.8 High
- x.org x server, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreXwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.CVE-2026-34000Fix available6.1 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handlingCVE-2026-33999Fix available7.8 High
- python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +21 more +23 moreIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()CVE-2026-4786Fix available7.0 High
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +21 more +23 moreApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorCVE-2026-34486In KEVPublic exploitFix availableEPSS 98.5%7.5 High
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreApache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by defaultCVE-2026-29146Fix available7.5 High
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- flatpak, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreFlatpak has a complete sandbox escape leading to host file access and code execution in the host contextCVE-2026-34078Fix available9.3 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2CVE-2026-5734Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2CVE-2026-5731Fix available9.8 Critical
- vim, red hat ai inference server 3.2, ai inference server 3.3 +26 more +28 moreVim modeline bypass via various options affects Vim < 9.2.0276CVE-2026-34982Fix available8.2 High
- linux, linux kernel, red hat enterprise linux 10 +22 more +24 morenfsd: fix heap overflow in NFSv4.0 LOCK replay cacheCVE-2026-31402Public exploitFix available9.8 Critical
- sudo project sudo, red hat ai inference server 3.3, enterprise linux 10 +25 more +27 moreIn Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during...CVE-2026-35535Fix available7.4 High
- openbsd openssh, red hat multicluster engine for kubernetes, openshift pipelines +29 more +31 moreIn OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome...CVE-2026-35385Fix available7.5 High
- corosync, red hat enterprise linux 10, enterprise linux 10.0 extended update support +17 more +19 moreCorosync: corosync: denial of service via integer overflow in join message validationCVE-2026-35092Fix available7.5 High
- corosync, red hat enterprise linux 10, enterprise linux 10.0 extended update support +17 more +19 moreCorosync: corosync: denial of service and information disclosure via crafted udp packetCVE-2026-35091Fix available8.2 High
- gnome gdk-pixbuf, red hat ai inference server 3.2, ai inference server 3.3 +35 more +37 moreGdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg imageCVE-2026-5201Public exploitFix available7.5 High
- libarchive, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +36 more +38 moreLibarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processingCVE-2026-5121Fix available7.5 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreLibsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishmentCVE-2026-5119Fix available5.9 Medium
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreAttacker can send a specifically crafted message before authentication that causes managesieve to...CVE-2026-27858Fix available7.5 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory...CVE-2026-27857Fix available4.3 Medium
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +4 more +6 moreDoveadm credentials are verified using direct comparison which is susceptible to timing oracle...CVE-2026-27856Fix available7.4 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be...CVE-2025-59032Fix available7.5 High
- gimp, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +13 more +15 moreGimp: gimp:memory disclosure and denial of service via specially crafted pcx imageCVE-2026-4887Fix available6.1 Medium
- squid-cache squid, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreSquid vulnerable to Denial of Service in ICP Request handlingCVE-2026-33526Fix available9.2 Critical
- squid-cache squid, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreSquid has Denial of Service in ICP Response handlingCVE-2026-32748Fix available8.7 High
- Show moreLoading…