Skip to contentRed Hat Hardened Images vulnerabilities
- f5 nginx open source, nginx plus, debian linux +15 more +17 moreNGINX ngx_http_rewrite_module vulnerabilityCVE-2026-9256Public exploitFix availableEPSS 10.9%9.2 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +54 more +56 moreInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshCVE-2026-46595Public exploitFix available10.0 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 moreInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsCVE-2026-42508Fix available9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +62 more +64 moreInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/sshCVE-2026-39835Fix available5.3 Medium
- opensuse libsolv, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreLibsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv fileCVE-2026-9149Fix available6.5 Medium
- opensuse libsolv, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreLibsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksumsCVE-2026-9150Fix available6.5 Medium
- memcached, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreIn memcached before 1.6.42, username data for SASL password database authentication has a timing...CVE-2026-47783Fix available8.1 High
- isc bind, bind 9, red hat enterprise linux 10 +6 more +8 moreSIG(0) validation during query flood may lead to undefined behaviorCVE-2026-5947Fix available7.5 High
- isc bind, bind 9, red hat enterprise linux 10 +9 more +11 moreInvalid handling of CLASS != INCVE-2026-5946Fix available7.5 High
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreUnbounded name compression in certain cases causes degradation of serviceCVE-2026-44390Fix available6.9 Medium
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreCrash during DNSSEC validation of malicious contentCVE-2026-42959Fix available8.7 High
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreHeap overflow with multiple NSID, COOKIE, PADDING EDNS optionsCVE-2026-42944Fix available8.7 High
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreJostle logic bypass degrades resolution performanceCVE-2026-42534Fix available6.9 Medium
- nlnet labs unbound, red hat data grid 8, enterprise linux 10 +10 more +12 moreLong list of incoming EDNS options degrades performanceCVE-2026-41292Fix available6.6 Medium
- isc bind, bind 9, red hat enterprise linux 10 +6 more +8 moreHeap use-after-free vulnerability in BIND 9 DNS-over-HTTPS implementationCVE-2026-3593Fix available7.4 High
- nlnet labs unbound, red hat enterprise linux 10, enterprise linux 6 +5 more +7 morePossible arbitrary code execution during DNSSEC validationCVE-2026-33278Fix available9.1 Critical
- isc bind, bind 9, red hat enterprise linux 10 +9 more +11 moreBIND 9 server memory exhaustion during GSS-API TKEY negotiationCVE-2026-3039Fix available7.5 High
- docker engine, moby docker engine, docker docker/daemon +20 more +22 moreDocker: `PUT /containers/{id}/archive` executes container binary on the hostCVE-2026-41567Public exploitFix available7.2 High
- hamba avro, red hat cryostat 4 on rhel 9, multicluster global hub 1.4.5 +11 more +13 moreiskorotkov/avro: CPU Exhaustion in Avro DecoderCVE-2026-46385Fix available8.7 High
- hamba avro, red hat cryostat 4 on rhel 9, multicluster global hub 1.4.5 +11 more +13 moreiskorotkov/avro: Integer Overflow in Avro DecoderCVE-2026-46384Fix available8.7 High
- vim, red hat enterprise linux 10, enterprise linux 10.2 extended update support +9 more +11 moreVim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code executionCVE-2026-43961Fix available7.8 High
- apostrophecms sanitize-html, red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +27 more +29 moreApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`CVE-2026-44990Fix available9.3 Critical
- postgresql, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 morePostgreSQL discloses MD5-hashed passwords via covert timing channelCVE-2026-6478Fix available6.5 Medium
- postgresql, red hat discovery 2, enterprise linux 10 +17 more +19 morePostgreSQL libpq lo_* functions let server superuser overwrite client stack memoryCVE-2026-6477Fix available8.8 High
- postgresql, red hat ansible automation platform 2.2, enterprise linux 10 +16 more +18 morePostgreSQL server undersizes allocations, via integer wraparoundCVE-2026-6473Fix available8.8 High
- f5 nginx open source, nginx plus, dos +26 more +28 moreNGINX ngx_http_rewrite_module vulnerabilityCVE-2026-42945Public exploitFix availableEPSS 68.0%9.2 Critical
- microsoft .net, .net 10.0, .net 8.0 +11 more +13 more.NET Elevation of Privilege VulnerabilityCVE-2026-35433Fix available7.3 High
- microsoft .net, .net 10.0, .net 8.0 +17 more +19 more.NET Elevation of Privilege VulnerabilityCVE-2026-32177Fix available7.3 High
- protobufjs project protobufjs, protobufjs protobuf.js, red hat openshift pipelines +20 more +22 moreprotobufjs: Code injection through bytes field defaults in generated toObject codeCVE-2026-44293Fix available7.7 High
- protobufjs project protobufjs, protobufjs protobuf.js, red hat openshift pipelines +13 more +15 moreprotobufjs: Denial of service through unbounded protobuf recursionCVE-2026-44289Fix available7.5 High
- microsoft .net, .net 10.0, .net 8.0 +8 more +10 moreASP.NET Core Denial of Service VulnerabilityCVE-2026-42899Fix available7.5 High
- openjsf webdriverio, red hat hardened images +1 moreWebdriverIO has Command Injection in the BrowserStack ServiceCVE-2026-25244Fix available9.8 Critical
- python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 moreurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APICVE-2026-44432Fix available8.9 High
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreDoS attack via DOMNode::C14N()CVE-2026-7263Fix available6.3 Medium
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreGlobal buffer over-read in mb_convert_encoding() with attacker-supplied encodingCVE-2026-6104Fix available6.3 Medium
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreSQL injection in pdo_firebird via NUL bytes in quoted stringsCVE-2025-14179Fix available7.4 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreSigned integer overflow in metaphone()CVE-2026-7568Fix available6.3 Medium
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreNULL pointer dereference in SOAP apache:Map decoder with missing <value>CVE-2026-7262Fix available2.9 Low
- chorny apache::session::generate::moduniqueid, apache\, red hat hardened images +2 moreApache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecureCVE-2026-50819.1 Critical
- beaugunderson ip-address, red hat confidential compute attestation, cryostat 4 +38 more +40 moreip-address: XSS in Address6 HTML-emitting methodsCVE-2026-42338Fix available5.3 Medium
- redis, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreredis-server RESTORE invalid memory access may allow remote code executionCVE-2026-25243Public exploitFix available7.7 High
- redis, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreredis-server Lua use-after-free may allow remote code executionCVE-2026-23631Public exploitFix available6.1 Medium
- redis, red hat enterprise linux 10, enterprise linux 10.0 extended update support +4 more +6 moreredis-server use-after-free in unblock client flow may allow remote code executionCVE-2026-23479Public exploitFix available7.7 High
- ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +19 more +21 morenet-imap: Command Injection via unvalidated Symbol inputsCVE-2026-42258Fix available5.8 Medium
- red hat enterprise linux 6, hardened images, vda-linux busybox mirror +2 moreBusyBox DHCPv6 Client Heap Buffer Overflow via DNS_SERVERSCVE-2026-29004Fix available7.2 High
- apache http server, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreApache HTTP Server: http2: double free and possible RCE on early resetCVE-2026-23918Public exploitFix availableEPSS 49.7%8.8 High
- Show moreLoading…