Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 moredevalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parseCVE-2026-22775Fix available7.5 High
- svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 moredevalue vulnerable to denial of service due to memory exhaustion in devalue.parseCVE-2026-22774Fix available7.5 High
- xmlsoft libxml2, ibm aix, vios +11 more +13 moreLibxml2: libxml2: denial of service via crafted xml catalogsCVE-2026-0992Fix available2.9 Low
- xmlsoft libxml2, ibm aix, vios +11 more +13 moreLibxml2: unbounded relaxng include recursion leading to stack overflowCVE-2026-0989Fix available3.7 Low
- xmlsoft libxml2, ibm aix, vios +11 more +13 moreLibxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processingCVE-2026-0990Fix available5.9 Medium
- google keras, red hat openshift ai (rhoai), openshift ai 2.25 +2 more +4 moreDenial of Service in Keras via Excessive Memory Allocation in HDF5 MetadataCVE-2026-0897Public exploitFix available7.1 High
- red hat build of keycloak, build of keycloak 26.4.9, jboss enterprise application platform 8 +1 more +3 moreOrg.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url pathsCVE-2026-09763.7 Low
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has a heap-buffer-overflow in urb_select_configurationCVE-2026-22859Fix available5.6 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has a global-buffer-overflow in crypto_base64_decodeCVE-2026-22858Fix available5.6 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreFreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_callCVE-2026-22855Fix available5.6 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +4 more +6 moreFreeRDP has a heap-buffer-overflow in ndr_read_uint8ArrayCVE-2026-22853Fix available6.8 Medium
- elastic kibana, red hat logging subsystem for red hat openshift, jboss enterprise application platform 8 +3 more +5 moreExternal Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini ConnectorCVE-2026-0532Fix available8.6 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreQemu-kvm: heap off-by-one in kvm xen physdevop_map_pirqCVE-2026-0665Fix available6.5 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +15 more +17 moreVsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsingCVE-2025-14242Fix available6.5 Medium
- red hat openshift dev spaces (rhosds) 3.22, openshift dev spaces (rhosds) 3.23, openshift dev spaces (rhosds) 3.24 +2 moreGithub.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333CVE-2025-12548Public exploit9.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreSandbox escape in the Messaging System componentCVE-2026-088110.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147CVE-2026-0891Fix available8.1 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the IPC componentCVE-2026-0882Fix available8.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to integer overflow in the Graphics componentCVE-2026-0880Fix available8.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions in the Graphics componentCVE-2026-0879Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL componentCVE-2026-0878Fix available8.0 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMitigation bypass in the DOM: Security componentCVE-2026-0877Fix available8.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: out-of-bounds read in libsoup websocket frame processingCVE-2026-0716Fix available4.8 Medium
- ollama, red hat ansible automation platform 2, openshift ai (rhoai) +2 moreOllama Multi-Modal Model Image Processing NULL Pointer DereferenceCVE-2025-155148.7 High
- envoyproxy gateway, red hat connectivity link 1 +1 moreEnvoy Extension Policy lua scripts injection causes arbitrary command executionCVE-2026-22771Fix available8.8 High
- apache struts, red hat enterprise linux 8, fuse 7 +2 more +4 moreApache Struts, Apache Struts: XXE vulnerability in outdated XWork componentCVE-2025-68493Public exploitFix availableEPSS 50.4%8.1 High
- gitlab, red hat openshift pipelines, openshift container platform 4 +2 moreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2025-9222Fix available8.7 High
- gitlab, red hat openshift pipelines, openshift container platform 4 +2 moreMissing Authorization in GitLabCVE-2025-13772Fix available7.1 High
- gitlab, red hat openshift pipelines, openshift container platform 4 +2 moreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabCVE-2025-13761Fix available8.0 High
- alibaba fastjson, red hat openshift service mesh 2, build of apache camel for spring boot 4 +5 more +7 moreFASTJSON Includes Functionality from Untrusted Control SphereCVE-2025-70974Fix available10.0 Critical
- vllm, red hat ai inference server, enterprise linux ai (rhel ai) 3 +1 more +3 morevLLM - Denial of Service via Unvalidated Multimodal EmbeddingsCVE-2026-56340Fix available8.7 High
- @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 moreReact Router vulnerable to XSS via Open RedirectsCVE-2026-22029Fix available8.0 High
- @tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 moreReact Router SSR XSS in ScrollRestorationCVE-2026-21884Fix available8.2 High
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session StorageCVE-2025-61686Public exploitFix availableEPSS 17.3%9.1 Critical
- @tanstack react-router, red hat ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +6 more +8 moreReact Router has XSS VulnerabilityCVE-2025-59057Public exploitFix available7.6 High
- red hat ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +2 more +4 moreAnsible-automation-platform/aap-gateway: aap-gateway: read-only personal access token (pat) bypasses write restrictionsCVE-2025-14025Fix available8.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreLibsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authenticationCVE-2026-0719Fix available8.6 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10 +1 moreKeycloak: keycloak authorization header parsing leading to potential security control bypassCVE-2026-07075.3 Medium
- webpros plesk obsidian, red hat openshift dev spaces +1 morePlesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS)...CVE-2025-65518Public exploit7.5 High
- red hat openshift dev spaces, technitium dnsserver +1 moreAn issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service...CVE-2025-503347.5 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +6 more +8 moreGIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityCVE-2025-15059Fix available7.8 High
- ruby zlib, red hat logging subsystem for red hat openshift, build of openjdk 1.8 +14 more +16 morezlib <= 1.3.1.2 untgz Global Buffer Overflow in TGZfname()CVE-2026-22184Fix availableDisputed4.6 Medium
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- pnpm, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +2 morepnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"CVE-2025-69264Fix available8.8 High
- pnpm, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +2 morepnpm Lockfile Integrity Bypass Allows Remote Dynamic DependenciesCVE-2025-69263Fix available7.5 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +33 more +35 moreUndertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrfCVE-2025-12543Fix available9.6 Critical
- aio-libs aiohttp, red hat openshift lightspeed, openshift service mesh 2 +18 more +20 moreAIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombCVE-2025-69223Fix available7.5 High
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 morejsPDF has Local File Inclusion/Path Traversal vulnerabilityCVE-2025-68428Public exploitFix available9.2 Critical
- gpsd project gpsd, red hat enterprise linux 10, enterprise linux 9 +2 moreAn integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of...CVE-2025-67269Fix available7.5 High
- gpsd project gpsd, red hat enterprise linux 10, enterprise linux 10.0 extended update support +1 more +3 moregpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers...CVE-2025-67268Fix available9.8 Critical
- Show moreLoading…