Skip to contentRed Hat Enterprise Linux 8 vulnerabilities
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruptionCVE-2026-34001Fix available7.8 High
- x.org x server, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreXwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.CVE-2026-34000Fix available6.1 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handlingCVE-2026-33999Fix available7.8 High
- microsoft .net, .net framework, .net 10.0 +15 more +17 more.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityCVE-2026-33116Fix available7.5 High
- microsoft .net, microsoft visual studio 2026 version 18.4, microsoft .net 10.0 +14 more +16 more.NET and Visual Studio Denial of Service VulnerabilityCVE-2026-32203Fix available7.5 High
- microsoft .net, .net 10.0, .net 8.0 +11 more +13 more.NET Spoofing VulnerabilityCVE-2026-32178Fix available7.5 High
- microsoft .net, powershell 7.6, microsoft .net 10.0 +11 more +13 more.NET Denial of Service VulnerabilityCVE-2026-26171Fix available7.5 High
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +24 more +26 morejq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedCVE-2026-40164Fix available7.5 High
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +38 more +40 morejq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted BuffersCVE-2026-39979Fix available6.9 Medium
- python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +21 more +23 moreIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()CVE-2026-4786Fix available7.0 High
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bombCVE-2026-40192Fix available8.7 High
- python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +22 more +24 moreUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressureCVE-2026-6100Fix available9.1 Critical
- simple-git project simple-git, red hat build of keycloak, enterprise linux 8 +5 more +7 moresimple-git has Command Execution via Option-Parsing BypassCVE-2026-28291Fix available8.1 High
- linux, linux kernel, red hat enterprise linux 10 +11 more +13 morenet: bonding: fix use-after-free in bond_xmit_broadcast()CVE-2026-31419Fix available7.8 High
- gleam, red hat enterprise linux 10, enterprise linux 7 +2 more +4 moreImproper Path Validation in Git Dependency Handling Allows Arbitrary File System ModificationCVE-2026-321468.3 High
- josdejong mathjs, red hat cryostat 4, developer hub +6 more +8 moreUnsafe array index getter in mathjsCVE-2026-41139Fix available8.8 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCVE-2026-40175Public exploitFix available4.8 Medium
- apache activemq, activemq broker, apache software foundation activemq all +10 more +12 moreApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMCVE-2026-39304Fix available7.5 High
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +21 more +23 moreApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorCVE-2026-34486In KEVPublic exploitFix availableEPSS 98.5%7.5 High
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreApache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by defaultCVE-2026-29146Fix available7.5 High
- libcap project libcap, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +34 more +36 moreLibcap: libcap: privilege escalation via toctou race condition in cap_set_file()CVE-2026-4878Fix available6.7 Medium
- axios, red hat cluster observability operator 1.5.0, cryostat 4 +60 more +62 moreAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFCVE-2025-62718Fix available6.3 Medium
- cryptography.io cryptography, red hat lightspeed core, migration toolkit for applications 8 +28 more +30 morecryptography has a buffer overflow if non-contiguous buffers were passed to APIsCVE-2026-39892Fix available6.9 Medium
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810Fix available8.2 High
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- go toolchain cmd/go, golang go, red hat openshift service mesh 2 +24 more +26 moreCode execution vulnerability in SWIG code generation in cmd/goCVE-2026-27140Fix available8.8 High
- flatpak, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreFlatpak has a complete sandbox escape leading to host file access and code execution in the host contextCVE-2026-34078Fix available9.3 Critical
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 +3 more +5 moreCockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injectionCVE-2026-4631Public exploitFix availableEPSS 15.5%9.8 Critical
- libarchive, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreLibarchive: a null pointer dereference vulnerability exists in the acl parser of libarchiveCVE-2026-5745Fix available5.5 Medium
- libraw, red hat enterprise linux 6, enterprise linux 7 +2 more +4 moreA heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of...CVE-2026-20911Fix available9.8 Critical
- libraw, red hat enterprise linux 6, enterprise linux 7 +13 more +15 moreA heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of...CVE-2026-21413Fix available9.8 Critical
- libraw, red hat enterprise linux 6, enterprise linux 7 +9 more +11 moreA heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw...CVE-2026-20889Fix available9.8 Critical
- libraw, red hat enterprise linux 6, enterprise linux 7 +9 more +11 moreA heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw...CVE-2026-24660Fix available8.1 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2CVE-2026-57359.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2CVE-2026-5734Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreIncorrect boundary conditions in the Graphics: WebGPU componentCVE-2026-57338.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2CVE-2026-5731Fix available9.8 Critical
- apache activemq, activemq broker, apache software foundation activemq all +8 more +10 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeansCVE-2026-34197In KEVPublic exploitFix availableEPSS 98.3%8.8 High
- academysoftwarefoundation openexr, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreOpenEXR: DWA Lossy Decoder Heap Out-of-Bounds WriteCVE-2026-34589Fix available8.4 High
- academysoftwarefoundation openexr, red hat ai inference server 3.3, enterprise linux 10 +9 more +11 moreOpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/WriteCVE-2026-34588Fix available8.6 High
- academysoftwarefoundation openexr, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreOpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)CVE-2026-34379Fix available7.1 High
- gnu tar, red hat discovery 2, enterprise linux 10 +7 more +9 moreTar: tar: hidden file injection via crafted archivesCVE-2026-5704Fix available5.0 Medium
- xiph theora, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibtheora: libtheora: denial of service or information disclosure via malformed avi file processingCVE-2026-5673Fix available5.6 Medium
- vim, red hat ai inference server 3.2, ai inference server 3.3 +26 more +28 moreVim modeline bypass via various options affects Vim < 9.2.0276CVE-2026-34982Fix available8.2 High
- linux, linux kernel, red hat enterprise linux 10 +22 more +24 morenfsd: fix heap overflow in NFSv4.0 LOCK replay cacheCVE-2026-31402Public exploitFix available9.8 Critical
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- sudo project sudo, red hat ai inference server 3.3, enterprise linux 10 +25 more +27 moreIn Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during...CVE-2026-35535Fix available7.4 High
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack: Algorithmic-Complexity DoS in Rack::Multipart::ParserCVE-2026-34827Fix available7.5 High
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack: Denial of Service via Unbounded Multipart File Upload Without Content-LengthCVE-2026-34829Fix available7.5 High
- Show moreLoading…