Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- red hat build of keycloak, build of keycloak 26.4.12 +1 moreOrg.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login pageCVE-2026-379806.9 Medium
- mozilla thin-vec, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreUse-After-Free and Double-Free in IntoIter::drop when element drop panicsCVE-2026-6654Fix available5.1 Medium
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +39 more +41 moreHTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-2332Public exploitFix available7.4 High
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory accessCVE-2026-34003Fix available7.8 High
- x.org x server, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreXorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handlingCVE-2026-34002Fix available6.1 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruptionCVE-2026-34001Fix available7.8 High
- x.org x server, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreXwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.CVE-2026-34000Fix available6.1 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +16 more +18 moreXorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handlingCVE-2026-33999Fix available7.8 High
- microsoft .net, .net framework, .net 10.0 +15 more +17 more.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityCVE-2026-33116Fix available7.5 High
- microsoft .net, microsoft visual studio 2026 version 18.4, microsoft .net 10.0 +14 more +16 more.NET and Visual Studio Denial of Service VulnerabilityCVE-2026-32203Fix available7.5 High
- microsoft .net, .net 10.0, .net 8.0 +11 more +13 more.NET Spoofing VulnerabilityCVE-2026-32178Fix available7.5 High
- microsoft .net, powershell 7.6, microsoft .net 10.0 +11 more +13 more.NET Denial of Service VulnerabilityCVE-2026-26171Fix available7.5 High
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +24 more +26 morejq: Algorithmic complexity DoS via hardcoded MurmurHash3 seedCVE-2026-40164Fix available7.5 High
- jqlang jq, red hat ai inference server 3.2, ai inference server 3.3 +38 more +40 morejq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted BuffersCVE-2026-39979Fix available6.9 Medium
- python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +21 more +23 moreIncomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()CVE-2026-4786Fix available7.0 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 +2 moreImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()CVE-2026-33908Fix available7.5 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 +2 moreImageMagick has a Heap Buffer Overflow via MVG decoderCVE-2026-33901Fix available7.5 High
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bombCVE-2026-40192Fix available8.7 High
- python software foundation cpython, red hat ai inference server 3.2, ai inference server 3.3 +22 more +24 moreUse-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressureCVE-2026-6100Fix available9.1 Critical
- simple-git project simple-git, red hat build of keycloak, enterprise linux 8 +5 more +7 moresimple-git has Command Execution via Option-Parsing BypassCVE-2026-28291Fix available8.1 High
- keras, keras-team keras-team/keras, red hat openshift ai (rhoai) +3 more +5 moreSafe Mode Bypass in keras-team/kerasCVE-2026-1462Fix available8.8 High
- linux, linux kernel, red hat enterprise linux 10 +11 more +13 morenet: bonding: fix use-after-free in bond_xmit_broadcast()CVE-2026-31419Fix available7.8 High
- r-project r, red hat enterprise linux ai (rhel ai) 3 +1 moreR 3.4.4 Local Buffer Overflow Windows XP SP3CVE-2019-256958.6 High
- gleam, red hat enterprise linux 10, enterprise linux 7 +2 more +4 moreImproper Path Validation in Git Dependency Handling Allows Arbitrary File System ModificationCVE-2026-321468.3 High
- red hat fast datapath for rhel 7, fast datapath for rhel 8, fast datapath for rhel 9 +6 more +8 moreOpenvswitch: open vswitch: denial of service via malformed ftp epasv commandCVE-2026-34956Fix available5.9 Medium
- josdejong mathjs, red hat cryostat 4, developer hub +6 more +8 moreUnsafe array index getter in mathjsCVE-2026-41139Fix available8.8 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCVE-2026-40175Public exploitFix available4.8 Medium
- red hat openshift ai (rhoai), redhat openshift ai, red hat openshift ai 2.16 +3 more +5 moreOdh-dashboard: odh dashboard kubernetes service account exposureCVE-2026-54838.5 High
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +2 more +4 moreDuplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrailCVE-2026-40217Public exploitFix availableEPSS 17.0%8.8 High
- apache activemq, activemq broker, apache software foundation activemq all +10 more +12 moreApache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOMCVE-2026-39304Fix available7.5 High
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +21 more +23 moreApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorCVE-2026-34486In KEVPublic exploitFix availableEPSS 98.5%7.5 High
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreApache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by defaultCVE-2026-29146Fix available7.5 High
- hdfgroup hdf5, red hat enterprise linux ai (rhel ai) 3 +1 moreHDF5: H5T__conv_struct Use After FreeCVE-2026-34734Fix available7.8 High
- helm, red hat helm cli 4.1 +1 moreHelm's plugin verification fails open when .prov is missing, allowing unsigned plugin installCVE-2026-35205Fix available8.4 High
- helm, red hat helm cli 4.1 +1 moreHelm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directoryCVE-2026-35204Public exploitFix available8.4 High
- libcap project libcap, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +34 more +36 moreLibcap: libcap: privilege escalation via toctou race condition in cap_set_file()CVE-2026-4878Fix available6.7 Medium
- axios, red hat cluster observability operator 1.5.0, cryostat 4 +60 more +62 moreAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFCVE-2025-62718Fix available6.3 Medium
- hashicorp tooling, red hat openshift container platform 4, trusted artifact signer +1 more +3 moreGo-getter may allow to arbitrary filesystem reads through git operationsCVE-2026-4660Public exploitFix available7.5 High
- bytecodealliance wasmtime, red hat connectivity link 1, enterprise linux 10 +2 moreWasmtime miscompiled guest heap access enables sandbox escape on aarch64 CraneliftCVE-2026-34971Fix available9.0 Critical
- openfga, red hat multicluster global hub 1.7.0, advanced cluster management for kubernetes 2.14 +3 more +5 moreOpenFGA Playground Preshared Key ExposureCVE-2026-40293Fix available6.5 Medium
- patrickjuchli basic-ftp, red hat developer hub 1.8, developer hub 1.9 +3 more +5 moreFTP Command Injection via CRLF in basic-ftpCVE-2026-39983Public exploitFix available8.6 High
- cryptography.io cryptography, red hat lightspeed core, migration toolkit for applications 8 +28 more +30 morecryptography has a buffer overflow if non-contiguous buffers were passed to APIsCVE-2026-39892Fix available6.9 Medium
- open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +4 more +6 moreOpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijackingCVE-2026-39883Public exploitFix available7.3 High
- meta react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack +1 more +3 moreReact Server Components have a Denial of Service VulnerabilityCVE-2026-23869Public exploitFix available7.5 High
- redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2 +8 more +10 moreMirror-registry: quay: server-side request forgery in proxy cache upstream registry configurationCVE-2026-325915.2 Medium
- redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2.0 +8 more +10 moreMirror-registry: remote code execution using pickle deserializationCVE-2026-325907.1 High
- redhat quay, red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2.0 +7 more +9 moreMirror-registry: quay: insecure direct object reference in blobuploadCVE-2026-325897.4 High
- red hat mirror registry for red hat openshift, mirror registry for red hat openshift 2 +1 moreMirror-registry: openshift mirror registry: user enumeration via authentication error messagesCVE-2025-142435.3 Medium
- red hat mirror registry for red hat openshift, redhat quay, red hat mirror registry for red hat openshift 2 +6 more +8 moreMirror-registry: quay: quay: server-side request forgery via log export functionalityCVE-2026-23776.5 Medium
- Show moreLoading…