Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +4 more +6 moreSystemd: systemd: privilege escalation via improper access control in registermachine d-bus methodCVE-2026-4105Fix available6.7 Medium
- libssh, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreLibssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windowsCVE-2025-14821Fix available7.8 High
- redhat fuse, red hat fuse 7 +1 moreFuse: privilege escalation via excessive /etc/passwd permissionsCVE-2025-578496.4 Medium
- red hat openshift data foundation 4.22, redhat openshift data foundation +1 moreNoobaa-core: excessive permissions of /etc could lead to escalation of privilege in the noobaa-core containerCVE-2025-87666.4 Medium
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +27 more +29 morePyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)CVE-2026-32597Fix available7.5 High
- locutus, red hat logging subsystem for red hat openshift +1 moreLocutus: RCE via unsanitized input in create_function()CVE-2026-32304Fix available9.8 Critical
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 moreundici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits ValidationCVE-2026-2229Fix available7.5 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +18 more +20 moreundici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the clientCVE-2026-1528Fix available7.5 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 on rhel 9 +19 more +21 moreundici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate DecompressionCVE-2026-1526Fix available7.5 High
- redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2 +2 more +4 moreMirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interfaceCVE-2026-23764.9 Medium
- psf black, red hat openshift lightspeed, ansible automation platform 2 +6 more +8 moreBlack: Arbitrary file writes from unsanitized user input in cache file nameCVE-2026-32274Fix available8.7 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Unbounded recursion DoS in parse() revive phaseCVE-2026-32141Fix available7.5 High
- debian linux, openbsd openssh, canonical ubuntu linux +39 more +41 moreVulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This...CVE-2026-3497Fix available2.7 Low
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: authentication bypass via digest authentication replay attackCVE-2026-3099Fix available5.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via authorization bypass in admin apiCVE-2026-2366Fix available3.1 Low
- red hat enterprise linux 10, enterprise linux 9, jboss core services +2 moreMod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injectionCVE-2026-32344.3 Medium
- defnull multipart, red hat lightspeed core, openshift lightspeed +8 more +10 moreReDoS in multipart 1.3.0 - `parse_options_header()`CVE-2026-28356Fix available7.5 High
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.11 +3 more +5 moreOrg.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest apiCVE-2026-3429Fix available4.2 Medium
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 moreWorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference ModeCVE-2026-31892Fix available8.9 High
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +1 more +3 moreArgo Workflows has unauthorized access to Argo Workflows TemplateCVE-2026-28229Fix available9.8 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.11, redhat build of keycloak +2 moreOrg.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpointCVE-2026-3911Fix available2.7 Low
- istio, red hat cert-manager operator for red hat openshift, externaldns operator +10 more +12 moreIstio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.CVE-2026-318378.7 High
- sequelize, red hat confidential compute attestation, enterprise linux 10 +2 more +4 moreSequelize v6 Vulnerable to SQL Injection via JSON Column Cast TypeCVE-2026-30951Public exploitFix available7.5 High
- giflib, red hat ai inference server 3.2, ai inference server 3.3 +18 more +20 moreGiflib contains a double-free vulnerability that is the result of a shallow copy in...CVE-2026-23868Fix available5.1 Medium
- simple-git project simple-git, red hat logging subsystem for red hat openshift, enterprise linux 8 +4 more +6 moresimple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key that enables RCECVE-2026-28292Fix available9.8 Critical
- microsoft asp.net core, asp.net core 10.0, asp.net core 8.0 +7 more +9 moreASP.NET Core Denial of Service VulnerabilityCVE-2026-26130Fix available7.5 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick has an integer overflow in DIB coder can result in out of bounds read or writeCVE-2026-28693Fix available8.1 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick has an uninitialized pointer dereference in JBIG decoderCVE-2026-28691Fix available7.5 High
- vllm, red hat ai inference server, enterprise linux ai (rhel ai) 3 +2 more +4 moreSSRF Protection Bypass in vLLMCVE-2026-25960Fix available7.1 High
- nltk, nltk nltk/nltk, red hat lightspeed core +5 more +7 moreArbitrary File Read via Absolute Path Input in nltk.util.filestring()CVE-2026-0846Fix available8.6 High
- quinn-rs quinn, red hat confidential compute attestation, logging subsystem for red hat openshift +13 more +15 moreQuinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingCVE-2026-31812Fix available8.7 High
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Sensitive information disclosure in client configuration handlingCVE-2026-24308Fix available7.5 High
- apache zookeeper, red hat amq broker 7.12.7, amq broker 7.13.5 +14 more +16 moreApache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManagerCVE-2026-24281Fix available7.4 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 moreIncorrect enforcement of email constraints in crypto/x509CVE-2026-27137Fix available7.5 High
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS ACL BypassCVE-2026-26017Fix available7.7 High
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS Loop Detection Denial of Service VulnerabilityCVE-2026-26018Fix available7.5 High
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreBinutils: gnu binutils: information disclosure or denial of service via out-of-bounds read in bfd linkerCVE-2026-3442Fix available6.1 Medium
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreBinutils: gnu binutils: information disclosure via specially crafted xcoff object fileCVE-2026-3441Fix available6.1 Medium
- redhat keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.14 +3 more +5 moreOrg.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated loginCVE-2026-3047Fix available8.8 High
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +5 more +7 moreOrg.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)CVE-2026-3009Fix available8.1 High
- mlc-ai xgrammar, red hat ai inference server, ai inference server 3.2 +3 more +5 morexgrammar: Multi-layer nesting causes DoSCVE-2026-25048Fix available8.7 High
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +35 more +37 moreThe Eclipse Jetty Server Artifact has a Gzip request memory leakCVE-2026-1605Fix available7.5 High
- isaacs node-tar, tar, red hat cryostat 4 +20 more +22 morenode-tar: Hardlink Path Traversal via Drive-Relative LinkpathCVE-2026-29786Public exploitFix available8.2 High
- backstage, linuxfoundation backstage plugin-techdocs-node, red hat developer hub 1.8 +2 more +4 more@backstage/plugin-techdocs-node: TechDocs Mkdocs Configuration Key Enables Arbitrary Code ExecutionCVE-2026-29186Fix available7.7 High
- python-markdown markdown, red hat external secrets operator for red hat openshift, multicluster engine for kubernetes +27 more +29 morePython-Markdown has an Uncaught ExceptionCVE-2025-69534Fix available7.5 High
- vibrantlabsai ragas, red hat openshift ai (rhoai) +1 moreRAGAS has an Arbitrary File Read vulnerabilityCVE-2025-45691Fix available7.5 High
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 moreSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074Fix available7.5 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- fasterxml jackson-core, red hat certificate system 10, enterprise linux 10 +2 more +4 morejackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource ExhaustionCVE-2026-29062Fix available8.7 High
- Show moreLoading…