Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +12 more +14 moreDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege EscalationCVE-2026-21721Public exploitFix available8.1 High
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +5 more +7 moreUnauthenticated DoS: avatar cache leaks goroutines when /avatar/:hash requests time outCVE-2026-21720Fix available7.5 High
- openssl, red hat cost management 4, ai inference server 3.2 +316 more +318 moreStack buffer overflow in CMS (Auth)EnvelopedData parsingCVE-2025-15467Public exploitFix availableEPSS 74.8%8.8 High
- fastapiexpert python-multipart, red hat lightspeed core, openshift lightspeed +11 more +13 morePython-Multipart has Arbitrary File Write via Non-Default ConfigurationCVE-2026-24486Public exploitFix available8.6 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdataCVE-2026-11903.1 Low
- red hat openshift virtualization 4Kubevirt: kubevirt: vm administration denial of service via guest agentCVE-2025-145256.4 Medium
- red hat build of quarkus 3.27.2.redhat, jboss enterprise application platform 8, jboss enterprise application platform expansion pack +1 more +3 moreHibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnectCVE-2025-14969Fix available4.3 Medium
- red hat openshift virtualization 4, rhel-9-cnv-4.19 +1 moreVirt-cdi-controller: unauthorized pvc cloning via dataimportcronCVE-2025-14459Fix available8.5 High
- facebook react, meta react-server-dom-parcel, react-server-dom-turbopack +3 more +5 moreReact Server Components have multiple Denial of Service VulnerabilitiesCVE-2026-23864Fix available7.5 High
- google protobuf, red hat ai inference server 3.2, ai inference server 3.3 +14 more +16 moreDenial of Service in Python ProtobufCVE-2026-0994Public exploitFix available8.2 High
- red hat amq broker 7, build of optaplanner 8, data grid 8 +20 more +22 moreOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injectionCVE-2026-0603Public exploitFix available8.3 High
- cli, red hat confidential compute attestation, cryostat 4 +32 more +34 morenpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityCVE-2026-0775Fix available7.0 High
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment DisclosureCVE-2026-20912Fix available9.1 Critical
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)CVE-2026-20897Fix available9.1 Critical
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)CVE-2026-20750Fix available9.1 Critical
- gitea, gitea open source git server, red hat openshift pipelines +2 moreGitea Web Attachment Deletion: Cross-Repository Unauthorized Deletion via Missing Repo Ownership CheckCVE-2026-20736Fix available7.5 High
- google sentencepiece, red hat ai inference server, enterprise linux ai (rhel ai) 3 +3 more +5 moreInvalid Memory Access in Sentencepiece,CVE-2026-1260Fix available8.5 High
- pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 morewheel Allows Arbitrary File Permission Modification via Path TraversalCVE-2026-24049Public exploitFix available7.1 High
- backstage, red hat developer hub 1.8, developer hub 1.9 +2 moreBackstage has a Possible Symlink Path Traversal in Scaffolder ActionsCVE-2026-24046Public exploitFix available7.1 High
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 moreArgo Workflows affected by stored XSS in the artifact directory listingCVE-2026-23960Fix available7.3 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- vllm, red hat ai inference server, ai inference server 3.2 +6 more +8 morevLLM affected by RCE via auto_map dynamic module loading during model initializationCVE-2026-22807Public exploitFix available8.8 High
- isc bind 9, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreMalformed BRID/HHIT records can cause named to terminate unexpectedlyCVE-2025-13878Fix available7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.11 +1 moreKeycloak-server: keycloak: improper access control in admin rest api leads to information disclosureCVE-2025-140832.7 Low
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled usersCVE-2025-14559Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race conditionCVE-2026-10353.1 Low
- oracle graalvm, graalvm for jdk, jdk +32 more +34 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...CVE-2026-21945Fix available7.5 High
- oracle graalvm, graalvm for jdk, jdk +19 more +21 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...CVE-2026-21932Fix available7.4 High
- external-secrets, external-secrets external secrets operator, red hat external secrets operator for red hat openshift +1 more +3 moreExternal Secrets Operator insecurely retrieves secrets through the getSecretKey templating functionCVE-2026-22822Fix available9.3 Critical
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uriCVE-2026-11805.8 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreHeap buffer overflow with attacker-controlled data in XBM parserCVE-2026-23876Fix available8.1 High
- isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 morenode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSCVE-2026-23950Fix available8.8 High
- dabeaz ply, red hat fence agents remediation operator, migration toolkit for containers +25 more +27 moreAn undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...CVE-2025-56005Public exploitFix availableDisputedEPSS 18.8%9.8 Critical
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreHeap-use-after-free in gdi_set_boundsCVE-2026-23884Fix available7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreHeap-use-after-free in update_pointer_newCVE-2026-23883Fix available7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +6 more +8 moreFreeRDP has heap-buffer-overflow in clear_decompress_bands_dataCVE-2026-23534Fix available7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has heap-buffer-overflow in clear_decompress_residual_dataCVE-2026-23533Fix available7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has heap-buffer-overflow in gdi_SurfaceToSurfaceCVE-2026-23532Fix available7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has heap-buffer-overflow in clear_decompressCVE-2026-23531Fix available7.7 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP has heap-buffer-overflow in planar_decompress_plane_rleCVE-2026-23530Fix available7.7 High
- kozea weasyprint, red hat ansible automation platform 2 +1 moreWeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP RedirectCVE-2025-68616Public exploitFix available7.5 High
- openstack keystonemiddleware, red hat openshift container platform 4.17, openshift container platform 4.18 +7 more +9 moreAn issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and...CVE-2026-22797Fix available9.9 Critical
- nodejs node, node.js, red hat enterprise linux 10 +6 more +8 moreA malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to...CVE-2025-59465Fix available7.5 High
- nodejs node, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreA flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are...CVE-2025-55131Fix available7.1 High
- nodejs node, node.js, red hat enterprise linux 10 +6 more +8 moreA flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow...CVE-2025-55130Public exploitFix available7.1 High
- vesparny marky, red hat logging subsystem for red hat openshift, satellite 6 +2 moreMarky 0.0.1 - Persistent Cross-Site ScriptingCVE-2021-478395.1 Medium
- pyasn1, debian linux, red hat lightspeed core +48 more +50 morepyasn1 has a DoS vulnerability in decoderCVE-2026-23490Fix available7.5 High
- go toolchain cmd/go, golang go, red hat enterprise linux 10 +30 more +32 moreArbitrary file write using cgo pkg-config directive in cmd/goCVE-2025-61731Fix available7.8 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreGlib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()CVE-2026-0988Fix available3.7 Low
- Show moreLoading…