Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- electron, red hat build of podman desktop, build of podman desktop - tech preview +2 moreElectron: Context Isolation bypass via contextBridge VideoFrame transferCVE-2026-34780Fix available8.4 High
- electron, red hat build of podman desktop, build of podman desktop - tech preview +2 moreElectron: Use-after-free in offscreen child window paint callbackCVE-2026-34774Fix available8.1 High
- electron, red hat build of podman desktop, build of podman desktop - tech preview +2 moreElectron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacksCVE-2026-34771Fix available7.5 High
- electron, red hat build of podman desktop, build of podman desktop - tech preview +2 moreElectron: Renderer command-line switch injection via undocumented commandLineSwitches webPreferenceCVE-2026-34769Fix available7.8 High
- sudo project sudo, red hat ai inference server 3.3, enterprise linux 10 +25 more +27 moreIn Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during...CVE-2026-35535Fix available7.4 High
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack: Algorithmic-Complexity DoS in Rack::Multipart::ParserCVE-2026-34827Fix available7.5 High
- rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 moreRack: Denial of Service via Unbounded Multipart File Upload Without Content-LengthCVE-2026-34829Fix available7.5 High
- rack, red hat satellite 6 +1 moreRack: Local file inclusion in `Rack::Static` via URL Prefix MatchingCVE-2026-34785Fix available7.5 High
- openbsd openssh, red hat multicluster engine for kubernetes, openshift pipelines +29 more +31 moreIn OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome...CVE-2026-35385Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.CVE-2026-4636Fix available8.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via excessive processing of openid connect scope parametersCVE-2026-4634Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: replay of action tokens via improper handling of single-use entriesCVE-2026-4325Fix available5.3 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flawCVE-2026-4282Public exploitFix available7.4 High
- red hat build of keycloak 26.2, build of keycloak 26.2.15, build of keycloak 26.4 +2 more +4 moreKeycloak: keycloak: information disclosure due to redirect_uri validation bypassCVE-2026-3872Fix available7.3 High
- lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +4 more +6 moreModel Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on LocalhostCVE-2026-34742Fix available7.6 High
- academysoftwarefoundation openexr, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreOpenEXR: integer overflow lead to OOB in HTJ2K decoderCVE-2026-34545Fix available8.4 High
- freedesktop libinput, fedoraproject fedora, red hat enterprise linux 10 +3 more +5 moreLibinput: libinput: information disclosure via dangling pointer in lua plugin handlingCVE-2026-35094Fix available3.3 Low
- freedesktop libinput, fedoraproject fedora, red hat enterprise linux 10 +3 more +5 moreLibinput: libinput: unauthorized code execution and information disclosure through lua bytecode pluginsCVE-2026-35093Fix available8.8 High
- corosync, red hat enterprise linux 10, enterprise linux 10.0 extended update support +17 more +19 moreCorosync: corosync: denial of service via integer overflow in join message validationCVE-2026-35092Fix available7.5 High
- corosync, red hat enterprise linux 10, enterprise linux 10.0 extended update support +17 more +19 moreCorosync: corosync: denial of service and information disclosure via crafted udp packetCVE-2026-35091Fix available8.2 High
- linux, linux kernel, red hat enterprise linux 10 +15 more +17 moreKVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTECVE-2026-23401Fix available5.5 Medium
- xmldom, red hat migration toolkit for applications 8, build of podman desktop +6 more +8 morexmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionCVE-2026-34601Fix available7.5 High
- opensc, red hat enterprise linux 10, enterprise linux 7 +2 more +4 moreLibopensc: opensc: multiple uses of uninitialized variableCVE-2025-13763Fix available5.7 Medium
- jlowin fastmcp, red hat openshift ai (rhoai), satellite 6.18 +2 moreFastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityCVE-2026-32871Fix available10.0 Critical
- linuxfoundation onnx, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreONNX: Path Traversal via SymlinkCVE-2026-27489Fix available8.7 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- gnome gdk-pixbuf, red hat ai inference server 3.2, ai inference server 3.3 +35 more +37 moreGdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg imageCVE-2026-5201Public exploitFix available7.5 High
- openstack glance, red hat openstack platform 16.2, openstack platform 17.1 +1 more +3 moreOpenStack Glance is affected by Server-Side Request Forgery (SSRF)CVE-2026-34881Fix available5.0 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreFreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB WriteCVE-2026-33986Fix available7.5 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP: ClearCodec resize_vbar_entry() Heap OOB WriteCVE-2026-33984Fix available7.5 High
- freerdp, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 moreFreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoSCVE-2026-33983Fix available6.5 Medium
- vim, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreVim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in...CVE-2026-34714Fix available9.2 Critical
- redhat virtio-win, red hat enterprise linux 10, enterprise linux 8 +2 more +4 moreVirtio-win: virtio-win: memory corruption via use-after-free in virtio blk device resetCVE-2026-51656.7 Medium
- redhat virtio-win, red hat enterprise linux 10, enterprise linux 8 +2 more +4 moreVirtio-win: virtio-win: denial of service via unvalidated descriptor count in unmap requestCVE-2026-51646.7 Medium
- libarchive, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +36 more +38 moreLibarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processingCVE-2026-5121Fix available7.5 High
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreCommand Injection in mlflow/mlflowCVE-2025-15379Fix available10.0 Critical
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +15 more +17 moreLibsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishmentCVE-2026-5119Fix available5.9 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 morePath Traversal Vulnerability in mlflow/mlflowCVE-2025-15036Fix available9.6 Critical
- gitlab, red hat openshift pipelines, openshift container platform 4 +2 moreImproper Handling of Parameters in GitLabCVE-2026-2370Fix available8.1 High
- capricorn86 happy dom, happy-dom, red hat ansible automation platform 2 +1 more +3 moreHappy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookiesCVE-2026-34226Fix available7.5 High
- langchain core, langchain-ai langchain, red hat openshift lightspeed +4 more +6 moreLangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functionsCVE-2026-34070Public exploitFix available7.5 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +11 more +13 moreHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and OptionsCVE-2026-33941Fix available8.3 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialCVE-2026-33940Fix available8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationCVE-2026-33939Fix available7.5 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockCVE-2026-33938Fix available8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type ConfusionCVE-2026-33937Public exploitFix available9.8 Critical
- moby, docker engine, red hat multicluster engine for kubernetes +7 more +9 moreMoby: Off-by-one error in plugin privilege validationCVE-2026-33997Fix available6.8 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreUnauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflowCVE-2025-15381Fix available8.1 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via malformed http request headersCVE-2026-28369Fix available8.7 High
- Show moreLoading…