Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +20 more +22 moreUndertow: undertow: request smuggling via `\r\r\r` as a header block terminatorCVE-2026-28367Fix available8.7 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via inconsistent header parsingCVE-2026-28368Fix available8.7 High
- grafana, red hat enterprise linux 10, enterprise linux 8 +1 more +3 moreRCE on Grafana via sqlExpressionsCVE-2026-27876Public exploitFix available9.1 Critical
- grafana, red hat enterprise linux 10, enterprise linux 8 +1 more +3 moreOpenFeature evaluation API reads input data with no boundsCVE-2026-27880Fix available7.5 High
- grafana, red hat enterprise linux 10, enterprise linux 10.0 extended update support +3 more +5 morePublic dashboards discloses all direct mode datasourcesCVE-2026-27877Fix available6.5 Medium
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerFieldCVE-2026-33433Fix available5.1 Medium
- gimp, red hat enterprise linux 6, enterprise linux 7 +6 more +8 moreGIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityCVE-2026-4152Fix available7.8 High
- firewalld, red hat enterprise linux 10, enterprise linux 10.0 extended update support +6 more +8 moreFirewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorizationCVE-2026-4948Fix available5.5 Medium
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik has Knative Ingress Rule Injection that Allows Host Restriction BypassCVE-2026-32695Fix available6.3 Medium
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreAttacker can send a specifically crafted message before authentication that causes managesieve to...CVE-2026-27858Fix available7.5 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreSending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory...CVE-2026-27857Fix available4.3 Medium
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +4 more +6 moreDoveadm credentials are verified using direct comparison which is susceptible to timing oracle...CVE-2026-27856Fix available7.4 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +4 more +6 moreDovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin....CVE-2026-24031Public exploitFix available7.7 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +16 more +18 moreManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be...CVE-2025-59032Fix available7.5 High
- vllm, red hat ai inference server, ai inference server 3.2 +5 more +7 morevLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-outCVE-2026-27893Fix available8.8 High
- capricorn86 happy-dom, happy dom, red hat ansible automation platform 2 +1 more +3 moreHappy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codeCVE-2026-33943Fix available8.8 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +16 more +18 moreForge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)CVE-2026-33896Fix available7.4 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +16 more +18 moreForge has signature forgery in Ed25519 due to missing S > L checkCVE-2026-33895Fix available7.5 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +22 more +24 moreForge has signature forgery in RSA-PKCS due to ASN.1 extra fieldCVE-2026-33894Fix available7.5 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +17 more +19 moreForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputCVE-2026-33891Fix available7.5 High
- red hat openshift ai (rhoai), redhat openshift ai, red hat openshift ai 2.25 +2 moreLlama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicyCVE-2025-128058.1 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: denial of service via use-after-free in soupserver during tls handshakeCVE-2026-2436Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, jboss enterprise application platform 8 +5 more +7 moreKeycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permissionCVE-2026-3121Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.11, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection apiCVE-2026-3190Fix available4.3 Medium
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926Fix available7.5 High
- nodejs node, node.js, red hat enterprise linux 10 +7 more +9 moreA flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received...CVE-2026-21710Public exploitFix availableEPSS 25.4%7.5 High
- freedesktop polkit, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePolkit: polkit: denial of service via unbounded input processing through standard inputCVE-2026-4897Fix available5.5 Medium
- theforeman foreman, red hat satellite 6, satellite 6.16 for rhel 8 +4 more +6 moreForman: foreman: remote code execution via command injection in websocket proxyCVE-2026-1961Public exploit8.0 High
- gimp, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +13 more +15 moreGimp: gimp:memory disclosure and denial of service via specially crafted pcx imageCVE-2026-4887Fix available6.1 Medium
- red hat build of keycloak, build of keycloak 26.4, build of keycloak 26.4.13 +7 more +9 moreOrg.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulationCVE-2026-4874Fix available3.1 Low
- squid-cache squid, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreSquid vulnerable to Denial of Service in ICP Request handlingCVE-2026-33526Fix available9.2 Critical
- squid-cache squid, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreSquid has Denial of Service in ICP Response handlingCVE-2026-32748Fix available8.7 High
- openbao, red hat cryostat 4 +1 moreOpenBao has Reflected XSS in its OIDC authentication error messageCVE-2026-33758Fix available9.4 Critical
- openbao, red hat cryostat 4 +1 moreOpenBao lacks user confirmation for OIDC direct callback modeCVE-2026-33757Fix available9.6 Critical
- linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation, red hat jboss enterprise application platform 8 +1 more +3 moreOpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code ExecutionCVE-2026-33701Public exploitFix available9.3 Critical
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS: Pre-auth remote server crash via WebSocket frame length overflow in wsReadCVE-2026-27889Fix available7.5 High
- gimp, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +13 more +15 moreGIMP XPM File Parsing Integer Overflow Remote Code Execution VulnerabilityCVE-2026-4154Fix available7.8 High
- gimp, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +13 more +15 moreGIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityCVE-2026-4153Fix available7.8 High
- gimp, red hat enterprise linux 6, enterprise linux 7 +2 more +4 moreGIMP ANI File Parsing Integer Overflow Remote Code Execution VulnerabilityCVE-2026-4151Fix available7.8 High
- gimp, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +13 more +15 moreGIMP PSD File Parsing Integer Overflow Remote Code Execution VulnerabilityCVE-2026-4150Fix available7.8 High
- apple ipados, macos, safari +19 more +21 moreThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26...CVE-2026-20664Fix available4.3 Medium
- apple ipados, macos, safari +21 more +23 moreThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26...CVE-2026-28859Fix available4.3 Medium
- apple ipados, macos, safari +7 more +9 moreA logic issue was addressed with improved state management. This issue is fixed in Safari 26.4,...CVE-2026-28861Fix available4.3 Medium
- apple ipados, macos, safari +19 more +21 moreThe issue was addressed with improved memory handling. This issue is fixed in Safari 26.4, iOS 26...CVE-2026-28857Fix available6.5 Medium
- isc kea, red hat enterprise linux 10, enterprise linux 10.0 extended update support +2 moreStack overflow in Kea daemonsCVE-2026-3608Fix available7.5 High
- isc bind, bind 9, red hat enterprise linux 10 +6 more +8 moreMemory leak in code preparing DNSSEC proofs of non-existenceCVE-2026-3104Fix available7.5 High
- isc bind, bind 9, red hat enterprise linux 10 +25 more +27 moreExcessive NSEC3 iterations cause high CPU load during insecure delegation validationCVE-2026-1519Fix available7.5 High
- codehaus-plexus plexus-utils, red hat cryostat 4, openshift developer tools and services +49 more +51 morePlexus-Utils has a Directory Traversal vulnerability in its extractFile methodCVE-2025-67030Fix available8.8 High
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS is vulnerable to pre-auth DoS through WebSockets client serviceCVE-2026-33219Fix available5.3 Medium
- linuxfoundation nats-server, red hat multicluster global hub 1.4.5, multicluster global hub 1.6.5 +2 more +4 moreNATS has pre-auth server panic via leafnode handlingCVE-2026-33218Fix available7.5 High
- Show moreLoading…