Skip to contentRed Hat Hardened Images vulnerabilities
- websockets ws, red hat cryostat 4, cryostat 4 on rhel 9 +47 more +49 morews: Uninitialized memory disclosureCVE-2026-45736Fix available4.4 Medium
- prometheus, red hat file integrity operator, logging for red hat openshift 6 +53 more +55 morePrometheus: remote read endpoint allows denial of service via crafted snappy payloadCVE-2026-42154Public exploitFix available7.5 High
- prometheus, red hat custom metric autoscaler operator for red hat openshift, file integrity operator +52 more +54 morePrometheus Azure AD remote write OAuth client secret exposed via config APICVE-2026-42151Fix available7.5 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: security bypass due to incorrect name constraint handlingCVE-2026-42011Fix available7.4 High
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +36 more +38 moreGnutls: gnutls: authentication bypass via nul character in usernameCVE-2026-42010Fix available7.1 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +29 more +31 moreGnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassemblyCVE-2026-33846Fix available7.5 High
- libssh2, red hat enterprise linux 6, enterprise linux 7 +9 more +11 morelibssh2 userauth.c userauth_password integer overflowCVE-2026-7598Fix available6.9 Medium
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +32 more +34 moreGnutls: gnutls: denial of service via dtls zero-length fragmentCVE-2026-33845Fix available7.5 High
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +13 more +15 moreGnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp responseCVE-2026-3832Fix available3.7 Low
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +31 more +33 moreGnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparisonCVE-2026-3833Fix available6.5 Medium
- qt, qt qtdeclarative, red hat multicluster global hub +10 more +12 morePossible QML code injection in VectorImage componentCVE-2025-14576Fix available7.4 High
- bytecodealliance wasmtime, red hat enterprise linux 10, hardened images +2 moreWasmtime: Panic when allocating a table exceeding the size of the host's address spaceCVE-2026-44216Fix available5.9 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +14 more +16 moreGnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removalCVE-2026-5419Fix available3.7 Low
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: information disclosure via heap overread in rsa key exchangeCVE-2026-5260Fix available8.2 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +21 more +23 moreGnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handlingCVE-2026-42015Fix available5.3 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +21 more +23 moreGnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pinCVE-2026-42014Fix available6.6 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: certificate validation bypass due to oversized subject alternative nameCVE-2026-42013Fix available8.2 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +24 more +26 moreGnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sansCVE-2026-42012Fix available7.1 High
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +46 more +48 moreGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityCVE-2026-42009Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +61 more +63 moreAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataCVE-2026-42039Fix available6.9 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyCVE-2026-42041Fix available4.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +56 more +58 moreAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0CVE-2026-42043Fix available7.2 High
- axios, red hat cryostat 4, gatekeeper 3 +59 more +61 moreAxios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`CVE-2026-42044Fix available6.5 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033Fix available7.4 High
- xmlsoft libxml2, ibm aix, vios +10 more +12 moreLibxml2: libxml2: denial of service via crafted xsd-validated documentCVE-2026-6732Fix available6.5 Medium
- ruby erb, red hat enterprise linux 10, enterprise linux 10.0 extended update support +10 more +12 moreERB has an @_init deserialization guard bypass via def_module / def_method / def_classCVE-2026-41316Fix available8.1 High
- ubuntu libefiboot, red hat enterprise linux 10, enterprise linux 7 +4 more +6 moreEfivar: efivar: denial of service due to stack overflow in device path node parsingCVE-2026-6862Fix available5.5 Medium
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreBinutils: binutils: arbitrary code execution via malformed xcoff object file processingCVE-2026-6846Fix available7.8 High
- gnu binutils, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreBinutils: binutils: denial of service vulnerabilities in readelf via crafted elf filesCVE-2026-6844Fix available5.5 Medium
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreBinutils: binutils: denial of service via crafted elf fileCVE-2026-6845Fix available5.0 Medium
- oracle graalvm, graalvm for jdk, jdk +31 more +33 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...CVE-2026-34282Fix available7.5 High
- oracle graalvm, graalvm for jdk, jdk +33 more +35 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...CVE-2026-22016Public exploitFix available7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreLibxpm: libxpm: denial of service via out-of-bounds read in xpm file parsingCVE-2026-4367Fix available5.5 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +21 more +23 moreundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentCVE-2026-9697Fix available7.4 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +19 more +21 moreundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuseCVE-2026-6734Fix available7.5 High
- nodejs node, node.js, red hat enterprise linux 10 +4 more +6 moreA flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt(...CVE-2026-48933Fix available7.5 High
- nodejs node, node.js, red hat enterprise linux 10 +4 more +6 moreA flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...CVE-2026-48618Fix available7.7 High
- microsoft asp.net core, asp.net core 10.0, visual studio 2026 version 18.5 +4 more +6 moreASP.NET Core Elevation of Privilege VulnerabilityCVE-2026-40372Fix availableEPSS 11.2%9.1 Critical
- protobufjs project protobufjs, protobufjs protobuf.js, red hat cryostat 4 +20 more +22 moreprotobufjs has an arbitrary code execution issueCVE-2026-41242Public exploitFix available9.4 Critical
- ngtcp2, red hat enterprise linux 10, enterprise linux 8 +2 more +4 morengtcp2 has a qlog transport parameter serialization stack buffer overflowCVE-2026-40170Fix available7.5 High
- containers podman, red hat enterprise linux 10, enterprise linux 8 +3 more +5 morePowerShell Command Injection in Podman HyperV MachineCVE-2026-33414Fix available4.0 Medium
- composer, red hat hardened images +1 moreComposer is vulnerable to Command Injection via Malicious Perforce RepositoryCVE-2026-40176Public exploitFix available7.8 High
- composer, red hat hardened images +1 moreComposer has Command Injection via Malicious Perforce ReferenceCVE-2026-40261Public exploitFix available8.8 High
- microsoft .net framework, .net framework 3.5, .net framework 3.5 and 4.7.2 +8 more +10 more.NET Framework Denial of Service VulnerabilityCVE-2026-236667.5 High
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- microsoft .net, .net framework, .net 10.0 +15 more +17 more.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityCVE-2026-33116Fix available7.5 High
- microsoft .net, microsoft visual studio 2026 version 18.4, microsoft .net 10.0 +14 more +16 more.NET and Visual Studio Denial of Service VulnerabilityCVE-2026-32203Fix available7.5 High
- microsoft .net, .net 10.0, .net 8.0 +11 more +13 more.NET Spoofing VulnerabilityCVE-2026-32178Fix available7.5 High
- microsoft .net, powershell 7.6, microsoft .net 10.0 +11 more +13 more.NET Denial of Service VulnerabilityCVE-2026-26171Fix available7.5 High
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +24 more +26 morejq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedCVE-2026-40164Fix available7.5 High
- Show moreLoading…