Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- red hat migration toolkit for virtualization, openshift pipelines, ansible automation platform 2 +8 more +10 morejsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path ExpressionsCVE-2026-1615Fix available9.2 Critical
- microsoft p11-kit, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +16 more +18 moreP11-kit: null dereference via c_derivekey with specific null parametersCVE-2026-2100Fix available5.3 Medium
- keylime, red hat enterprise linux 10, enterprise linux 10.0 extended update support +9 more +11 moreKeylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authenticationCVE-2026-1709Fix available9.4 Critical
- pydantic ai, pydantic-ai, red hat enterprise linux ai (rhel ai) 3 +2 morePydantic AI affected by Stored XSS via Path Traversal in Web UI CDN URLCVE-2026-25640Fix available7.1 High
- pydantic ai, pydantic-ai, red hat enterprise linux ai (rhel ai) 3 +2 morePydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download HandlingCVE-2026-25580Fix available8.6 High
- red hat ansible automation platform 2, ansible automation platform 2.6 +1 moreAnsible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiCVE-2026-05984.2 Medium
- go toolchain cmd/cgo, golang go, red hat enterprise linux 10 +31 more +33 morePotential code smuggling via doc comments in cmd/cgoCVE-2025-61732Fix available8.6 High
- apache tomcat, tomcat native, red hat enterprise linux 10 +10 more +12 moreApache Tomcat Native, Apache Tomcat: OCSP revocation bypassCVE-2026-24734Fix available7.5 High
- lfprojects mcp typescript sdk, modelcontextprotocol typescript-sdk, red hat ansible automation platform 2.6 +2 more@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCVE-2026-25536Fix available7.1 High
- linux, linux kernel, red hat enterprise linux 10 +12 more +14 morenet/sched: Enforce that teql can only be used as root qdiscCVE-2026-23074Fix available7.8 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http request smuggling via malformed chunk headersCVE-2026-1801Public exploitFix available5.3 Medium
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection via QuerySet.order_by and FilteredRelationCVE-2026-1312Public exploitFix available5.4 Medium
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection in column aliases via control charactersCVE-2026-1287Fix available5.4 Medium
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection via raster lookups on PostGISCVE-2026-1207Public exploitFix availableEPSS 12.8%5.4 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +4 more +6 moreFreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_threadCVE-2026-24678Fix available8.7 High
- gnome localsearch, red hat enterprise linux 10, enterprise linux 8 +2 more +4 moreLocalsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tagsCVE-2026-1767Fix available5.6 Medium
- gnome localsearch, red hat enterprise linux 10, enterprise linux 8 +2 more +4 moreLocalsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files.CVE-2026-1766Fix available5.6 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 moreLocalsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potential information disclosure via crafted mp3 filesCVE-2026-1765Fix available5.6 Medium
- gnome localsearch, red hat enterprise linux 10, enterprise linux 8 +2 more +4 moreLocalsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leads to denial of service or information disclosure when parsing mp3 filesCVE-2026-1764Fix available5.6 Medium
- @clerk fastify, red hat enterprise linux ai (rhel ai) 3, openshift ai (rhoai) +3 more +5 moreFastify's Content-Type header tab character allows body validation bypassCVE-2026-25223Fix available7.5 High
- locutus, red hat logging subsystem for red hat openshift +1 moreLocutus is vulnerable to Prototype PollutionCVE-2026-25521Fix available9.4 Critical
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 morejsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript ExecutionCVE-2026-24737Fix available8.1 High
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM leaks a heap address when PIL throws an errorCVE-2026-22778Public exploitFix availableEPSS 18.3%9.8 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: soupserver: denial of service via http request smugglingCVE-2026-1760Fix available5.3 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreLibsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http responseCVE-2026-1761Fix available8.6 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreLibxml2: memory leak leading to local denial of service in xmllint interactive shellCVE-2026-1757Fix available6.2 Medium
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +1 more +3 moreFog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validationCVE-2026-1530Fix available8.1 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +2 more +4 moreForeman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verificationCVE-2026-1531Fix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.9 +1 moreOrg.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin apiCVE-2025-13881Fix available2.7 Low
- backstage, red hat developer hub 1.8, developer hub 1.9 +1 more +3 more@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooksCVE-2026-25153Fix available7.7 High
- red hat build of apicurio registry 2, build of quarkus, data grid 8 +7 more +9 moreUndertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacksCVE-2024-4027Fix available7.5 High
- red hat osim, redhat open security issue management +1 moreosim: Path Traversal via query parameters in Nginx configurationCVE-2026-16167.5 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Denial of Service via connection exhaustion in applications using Cache ComponentsCVE-2026-44579Public exploitFix available7.5 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Server-side request forgery in applications using WebSocket upgradesCVE-2026-44578Public exploitFix availableEPSS 35.5%8.6 High
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Denial of Service in the Image Optimization APICVE-2026-44577Fix available5.9 Medium
- vercel next.js, red hat enterprise linux 10, enterprise linux 7 +7 more +9 moreNext.js: Middleware / Proxy bypass in Pages Router applications using i18nCVE-2026-44573Fix available7.5 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: credential leakage via http redirectsCVE-2026-1539Fix available5.8 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition headerCVE-2026-1536Fix available5.8 Medium
- isaacs node-tar, tar, red hat cryostat 4 +27 more +29 morenode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalCVE-2026-24842Fix available8.2 High
- dchester jsonpath, red hat migration toolkit for virtualization, openshift pipelines +11 more +13 moreJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.jsCVE-2025-61140Fix available9.8 Critical
- browserstack browserstack-local, red hat fuse 7 +1 moreBrowserStack Local vulnerable to Command Injection through logfile variableCVE-2025-57283Fix available7.8 High
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`CVE-2026-24779Fix available7.1 High
- linuxfoundation pytorch, red hat openshift ai (rhoai), openshift ai 2.25 +2 morePyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint FilesCVE-2026-24747Fix available8.8 High
- gnupg, gpg4win, red hat enterprise linux 10 +5 more +7 moreIn GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the...CVE-2026-24882Fix available8.4 High
- gnupg, gpg4win, red hat enterprise linux 10 +4 more +6 moreIn GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized...CVE-2026-24881Fix available8.1 High
- mozilla firefox, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreUse-after-free in the Layout: Scrolling and Overflow componentCVE-2026-248698.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreGlib: glib: memory corruption via integer overflow in unicode case conversionCVE-2026-1489Fix available5.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreGlib: glib: local denial of service via buffer underflow in content type parsingCVE-2026-1485Fix available2.8 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreGlib: integer overflow leading to buffer underflow and out-of-bounds write in glib g_base64_encode()CVE-2026-1484Fix available4.2 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http header injection via specially crafted urls when an http proxy is configuredCVE-2026-1467Fix available5.8 Medium
- Show moreLoading…