Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS allows MQTT clients to bypass ACL checksCVE-2026-33217Fix available7.1 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has MQTT plaintext password disclosureCVE-2026-33216Fix available8.6 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS Server panic via malicious compression on leafnode portCVE-2026-29785Fix available7.5 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS credentials are exposed in monitoring port via command-line argvCVE-2026-33247Fix available7.4 High
- mozilla thunderbird, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreOut of bounds read in IMAP parsingCVE-2026-4371Fix available7.4 High
- libtiff, debian linux, red hat ai inference server 3.2 +30 more +32 moreLibtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processingCVE-2026-4775Fix available7.8 High
- f5 nginx open source, nginx plus, red hat enterprise linux 10 +9 more +11 moreNGINX ngx_mail_auth_http_module vulnerabilityCVE-2026-27651Fix available8.7 High
- f5 nginx open source, nginx plus, red hat enterprise linux 10 +9 more +11 moreNGINX ngx_http_dav_module vulnerabilityCVE-2026-27654Public exploitFix availableEPSS 26.5%8.8 High
- f5 nginx open source, nginx plus, red hat enterprise linux 10 +10 more +12 moreNGINX ngx_http_mp4_module vulnerabilityCVE-2026-32647Fix available8.5 High
- f5 nginx open source, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreNGINX ngx_http_mp4_module vulnerabilityCVE-2026-27784Fix available8.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Firefox 149 and Thunderbird 149CVE-2026-47299.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149CVE-2026-4721Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149CVE-2026-4720Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMitigation bypass in the Networking: HTTP componentCVE-2026-4700Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Layout: Text and Fonts componentCVE-2026-4699Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreJIT miscompilation in the JavaScript Engine: JIT componentCVE-2026-4698Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Audio/Video: Web Codecs componentCVE-2026-4697Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the Layout: Text and Fonts componentCVE-2026-4696Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Audio/Video: Web Codecs componentCVE-2026-4695Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions, integer overflow in the Graphics componentCVE-2026-4694Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Audio/Video: Playback componentCVE-2026-4693Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape in the Responsive Design Mode componentCVE-2026-4692Public exploitFix available10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the CSS Parsing and Computation componentCVE-2026-4691Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM componentCVE-2026-4690Fix available8.6 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM componentCVE-2026-4689Fix available10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to use-after-free in the Disability Access APIs componentCVE-2026-4688Fix available10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions in the Telemetry componentCVE-2026-4687Fix available8.6 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Graphics: Canvas2D componentCVE-2026-4686Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Graphics: Canvas2D componentCVE-2026-4685Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreRace condition, use-after-free in the Graphics: WebRender componentCVE-2026-4684Fix available7.5 High
- gstreamer, debian linux, freedesktop gst-plugins-good +6 more +8 moreGstreamer: incomplete fix of cve-2026-1940CVE-2026-1940Fix available5.1 Medium
- rubyonrails rails, rails activestorage, red hat 3scale api management platform 2 +2 moreRails Active Storage has possible Path Traversal in DiskServiceCVE-2026-33195Fix available8.0 High
- vim, red hat ai inference server 3.2, ai inference server 3.3 +28 more +30 moreVim affected by Command injection via newline in glob()CVE-2026-33412Fix available5.6 Medium
- gnu binutils, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreBinutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd libraryCVE-2026-4647Fix available6.1 Medium
- red hat build of keycloak, build of keycloak 26.4.12 +1 moreKeycloak: keycloak: user enumeration via differential error messagesCVE-2026-4633Fix available3.7 Low
- red hat build of keycloak, build of keycloak 26.4.12, jboss enterprise application platform 8 +2 more +4 moreKeycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access controlCVE-2026-46284.3 Medium
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Missing cryptographic validation during DSA signing enables private key extractionCVE-2026-4601Fix available9.4 Critical
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce GenerationCVE-2026-4599Fix available9.3 Critical
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputsCVE-2026-4598Fix available8.7 High
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Negative Exponent Handling Leads to Signature Verification BypassCVE-2026-4602Fix available8.7 High
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublicCVE-2026-4600Fix available9.1 Critical
- red hat openshift ai (rhoai)Feast: unauthenticated arbitrary file readCVE-2026-235367.5 High
- libfuse, red hat enterprise linux 7, enterprise linux 8 +2 moreUse After Free in libfuseCVE-2026-33150Public exploitFix available7.8 High
- python, python software foundation cpython, red hat ai inference server 3.2 +24 more +26 morewebbrowser.open() allows leading dashes in URLsCVE-2026-4519Fix available7.0 High
- traefik, red hat openshift dev spaces 3.27, openshift dev spaces 3.28 +1 more +3 moreTraefik mTLS bypass via fragmented ClientHello SNI extraction failureCVE-2026-32305Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreQemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob writeCVE-2026-3842Fix available7.8 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Prototype Pollution via parse()CVE-2026-33228Fix available8.9 High
- artifex software inc. *pymupdf* pymupdf, red hat enterprise linux ai (rhel ai) 3 +1 moreCVE-2026-3029CVE-2026-3029Fix available7.5 High
- libarchive, red hat enterprise linux 10, enterprise linux 6 +8 more +10 moreLibarchive: libarchive: denial of service via malformed iso file processingCVE-2026-4426Fix available6.5 Medium
- libarchive, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +39 more +41 moreLibarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processingCVE-2026-4424Fix available7.5 High
- Show moreLoading…