Skip to contentRed Hat Enterprise Linux vulnerabilities
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 10.0 extended update support +7 more +9 moreGvfs: gvfs-admin socket ownership race permits local rootCVE-2026-88924Fix available7.0 High
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +1 more +3 moreEvolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restrictionCVE-2026-88859Fix available6.3 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 morePcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --tokenCVE-2026-84828Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreCrun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chownCVE-2026-88265Fix available5.6 Medium
- containers crun, red hat enterprise linux 10, enterprise linux 8 +4 more +6 moreCrun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfsCVE-2026-88264Fix available5.6 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreCrun: crun: rootful krun with passt executes container payload as host rootCVE-2026-84042Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreFreeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted urlCVE-2026-181478.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreCups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)CVE-2026-87876Fix available3.0 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreCups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length boundCVE-2026-87875Fix available4.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreSssd: sssd: idp authentication prefix comparison allows cross-user impersonationCVE-2026-87853Fix available7.5 High
- red hat fast datapath for rhel 10, fast datapath for rhel 8, fast datapath for rhel 9 +4 more +6 moreDpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handlerCVE-2026-86564Fix available3.3 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle blockCVE-2026-180906.1 Medium
- red hat cert manager support for red hat openshift release 1.20, cost management on-premise 1, enterprise linux 10 +22 more +24 moreLibxml2: double-free/uaf in libxml2 python bindingsCVE-2026-74860Fix available8.5 High
- red hat enterprise linux 8, enterprise linux 9 +1 moreGnome-tweaks: path traversal in theme installerCVE-2026-748596.8 Medium
- red hat certificate system 9, enterprise linux 10, enterprise linux 10.0 extended update support +13 more +15 morePki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)CVE-2026-76561Fix available7.2 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGlib2: toctou symlink race in `g_file_create_replace_destination` fallback pathCVE-2026-864695.3 Medium
- red hat directory server 11, directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8 +13 more +15 more389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editorCVE-2026-19843Public exploitFix available8.4 High
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +19 more +21 more389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary propertyCVE-2026-18922Fix available9.8 Critical
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +20 more +22 more389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_searchCVE-2026-184537.5 High
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8, directory server 11.9 for rhel 8 +20 more +22 more389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()CVE-2026-183557.5 High
- red hat directory server 11, directory server 11.5 e4s for rhel 8, directory server 11.7 e4s for rhel 8 +21 more +23 more389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dnCVE-2026-765607.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreFreeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of serviceCVE-2026-796788.1 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +12 more +14 moreIpa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aciCVE-2026-76578Public exploit9.8 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 morePolkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflowCVE-2026-85498Fix available3.5 Low
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: toctou race condition allows symlink redirectionCVE-2026-769255.8 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 moreLibtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksizeCVE-2026-85769Public exploitFix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body readCVE-2026-85534Fix available5.9 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreCorosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systemsCVE-2026-816666.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +13 more +15 moreCorosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassemblyCVE-2026-81665Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +3 more +5 moreLibsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body uploadCVE-2026-85197Fix available7.6 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 7 +4 more +6 moreJwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verificationCVE-2026-841855.9 Medium
- red hat enterprise linux 7, enterprise linux 8, enterprise linux 9 +1 more +3 moreGfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walkCVE-2026-71224Fix available4.7 Medium
- red hat enterprise linux 7, enterprise linux 8, enterprise linux 9 +1 more +3 moreGfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processingCVE-2026-71222Fix available5.3 Medium
- red hat enterprise linux 7, enterprise linux 8, enterprise linux 9 +1 more +3 moreGfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemetaCVE-2026-71221Fix available7.0 High
- red hat enterprise linux 7, enterprise linux 8, enterprise linux 9 +1 more +3 moreGfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_editCVE-2026-71220Fix available7.0 High
- red hat enterprise linux 7, enterprise linux 8, enterprise linux 9 +1 more +3 moreGfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversalCVE-2026-71219Fix available4.7 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreGstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate headerCVE-2026-85150Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 8 +11 more +13 moreBubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setupCVE-2026-87766Fix available8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreRpm: command injection in rpmuncompress via unescaped filenames passed to popen()CVE-2026-848387.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball pathCVE-2026-84837Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreUtil-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinksCVE-2026-78409Fix available7.0 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirectionCVE-2026-78410Fix available7.8 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authorityCVE-2026-78408Fix available7.9 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreFreeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.htmlCVE-2026-536834.3 Medium
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGvfs: mtp: out-of-bounds read in do_read()CVE-2026-84270Fix available4.3 Medium
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGvfs: afp: heap-based buffer overflow in dsi read pathCVE-2026-84269Fix available6.5 Medium
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGvfs: sftp: uninitialized heap disclosure in read_string()CVE-2026-84267Fix available4.3 Medium
- [unknown] gvfs, red hat enterprise linux 10, enterprise linux 10.0 extended update support +13 more +15 moreGvfs: sftp: heap-based buffer overflow in read_reply()CVE-2026-84268Fix available8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreRpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenamesCVE-2026-84233Fix available7.0 High
- red hat certificate system 9, enterprise linux 10, enterprise linux 6 +3 more +5 morePki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hostsCVE-2026-536825.3 Medium
- Show moreLoading…