Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- feast-dev feast-dev/feast, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreArbitrary Code Execution in feast-dev/feastCVE-2025-11157Fix available7.8 High
- gitoxidelabs gix-date, gitoxide, red hat logging subsystem for red hat openshift +3 more +5 moreGix-date: gix-date: undefined behavior due to invalid string generationCVE-2026-0810Fix available7.1 High
- red hat libnbd, enterprise linux 10, enterprise linux 8 +2 more +4 moreLibnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uriCVE-2025-14946Fix available4.8 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreQemu-kvm: unbounded allocation in virtio-cryptoCVE-2025-14876Fix available5.5 Medium
- red hat openshift container platform 4Ose-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanismCVE-2025-144436.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak: keycloak idor in realm client creating/deletingCVE-2025-147776.0 Medium
- red hat lightspeed (formerly insights) for runtimes 1.0, runtimes inventory operator +1 moreInsights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commandsCVE-2025-113938.7 High
- red hat openshift gitops, redhat-developer gitops-operator, red hat openshift gitops 1.16 +2 more +4 moreOpenshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobsCVE-2025-13888Fix available9.1 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreNetworkmanager: networkmanager file accessCVE-2025-9615Fix available3.3 Low
- apple ipados, macos, safari +20 more +22 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in iOS...CVE-2025-43511Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +15 more +17 moreLibsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)CVE-2025-14523Fix available8.2 High
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +27 more +29 moreGlib: integer overflow in glib gio attribute escaping causes heap buffer overflowCVE-2025-14512Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosureCVE-2025-14082Fix available2.7 Low
- gnome glib, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +26 more +28 moreGlib: glib: buffer underflow in gvariant parser leads to heap corruptionCVE-2025-14087Fix available5.6 Medium
- util-linux, red hat cert manager support for red hat openshift release 1.18, ceph storage 7 +11 more +13 moreUtil-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernamesCVE-2025-14104Fix available6.1 Medium
- the webkitgtk team webkitgtk, red hat enterprise linux 6, enterprise linux 7 +15 more +17 moreWebkitgtk: processing maliciously crafted web content may lead to an unexpected process crashCVE-2025-66287Fix available8.8 High
- ansible-collections ansible community general collection, red hat ceph storage 5, ceph storage 6 +5 more +7 moreAnsible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose outputCVE-2025-14010Fix available5.5 Medium
- red hat openshift serverless, build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +29 more +31 moreUndertow: outofmemory when parsing form data encoding with application/x-www-form-urlencodedCVE-2024-3884Fix available7.5 High
- the webkitgtk team webkitgtk, red hat enterprise linux 6, enterprise linux 7 +15 more +17 moreWebkit: webkitgtk: remote user-assisted information disclosure via file drag-and-dropCVE-2025-13947Public exploitFix available7.4 High
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +2 moreAbrt: command-injection in abrt leading to local privilege escalationCVE-2025-12744Public exploitFix available8.8 High
- red hat openshift dev spacesCodeready-ws: privilege escalation via excessive /etc/passwd permissionsCVE-2025-578506.4 Medium
- nodemailer, red hat advanced cluster management for kubernetes 2, ceph storage 8 +4 more +6 moreNodemailer: nodemailer: denial of service via crafted email address headerCVE-2025-14874Fix available7.5 High
- red hat openstack platform 13 (queens), openstack platform 16.2, openstack platform 17.1 +2 morePython-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' featureCVE-2021-4472Fix available6.5 Medium
- gnome glib, red hat ceph storage 8, discovery 2 +58 more +60 moreGlib: integer overflow in in g_escape_uri_string()CVE-2025-13601Fix available7.7 High
- keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 moreOrg.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federationCVE-2025-13467Fix available5.5 Medium
- the webkitgtk team webkitgtk, red hat enterprise linux 6, enterprise linux 7 +15 more +17 moreWebkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dosCVE-2025-13502Fix available7.5 High
- red hat cert manager support for red hat openshift release 1.18, ceph storage 8, discovery 2 +11 more +13 moreGnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() functionCVE-2025-9820Fix available4.0 Medium
- keylime project keylime, red hat enterprise linux 10, enterprise linux 10.0 extended update support +4 more +6 moreKeylime: keylime: registrar allows identity takeover via duplicate uuid registrationCVE-2025-13609Fix available8.2 High
- redhat satellite, the foreman foreman, red hat satellite 6.15 for rhel 8 +6 more +8 moreForeman: satellite: graphql api permission bypass leads to information disclosureCVE-2025-9572Fix available5.0 Medium
- redhat ansible automation platform, red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +5 more +7 moreAap-gateway: improper path validation in gateway allows credential exfiltrationCVE-2025-99096.7 Medium
- gnu grub2, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreGrub2: use-after-free in net_set_vlanCVE-2025-54770Fix available4.9 Medium
- gnu grub2, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreGrub2: missing unregister call for normal_exit command may lead to use-after-freeCVE-2025-61664Fix available4.9 Medium
- gnu grub2, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreGrub2: missing unregister call for normal commands may lead to use-after-freeCVE-2025-61663Fix available4.9 Medium
- gnu grub2, red hat enterprise linux 10, enterprise linux 10.0 extended update support +23 more +25 moreGrub2: missing unregister call for gettext command may lead to use-after-freeCVE-2025-61662Fix available7.8 High
- gnu grub2, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreGrub2: grub2: out-of-bounds write via malicious usb deviceCVE-2025-61661Fix available4.8 Medium
- gnu grub2, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreGrub2: use-after-free in grub_file_close()CVE-2025-54771Fix available4.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibvirt: information disclosure via world-readable vm snapshotsCVE-2025-13193Fix available5.5 Medium
- keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.4 +2 moreKeycloak-server: debug default bind addressCVE-2025-11538Fix available6.8 Medium
- rhobs observability-operator, red hat cluster observability operator 1.3.1 +1 moreObservability-operator: observability operator privilege escalationCVE-2025-2843Fix available8.8 High
- latchset kdcproxy, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 morePython-kdcproxy: remote dos via unbounded tcp upstream bufferingCVE-2025-590895.9 Medium
- latchset kdcproxy, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 morePython-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvCVE-2025-590888.6 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibvirt: denial of service in xml parsingCVE-2025-12748Public exploitFix available5.5 Medium
- red hat single sign-on 7Rhsso: open redirectCVE-2025-127896.1 Medium
- 3scale porta, red hat 3scale api management platform 2 +1 more3scale-porta: readonly fields not validated server-sideCVE-2024-121257.5 High
- nicholas j humfrey ruby-mqtt, red hat satellite 6 +1 moreRubygem-mqtt: rubygem-mqtt hostname validationCVE-2025-12790Fix available7.4 High
- the foreman foreman, red hat satellite 6, satellite 6.15 for rhel 8 +4 more +6 moreForeman: os command injection via ct_location and fcct_location parametersCVE-2025-10622Fix available8.0 High
- apple ipados, macos, safari +20 more +22 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in...CVE-2025-43457Fix available6.5 Medium
- apple ipados, macos, safari +8 more +10 moreThe issue was addressed with improved memory handling. This issue is fixed in iOS 26.1 and iPadOS...CVE-2025-43441Fix available4.3 Medium
- apple ipados, macos, safari +8 more +10 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in...CVE-2025-43438Fix available4.3 Medium
- apple ipados, macos, safari +9 more +11 moreThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.1,...CVE-2025-43433Fix available8.8 High
- Show moreLoading…