Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +14 more +16 moreGnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removalCVE-2026-5419Fix available3.7 Low
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: information disclosure via heap overread in rsa key exchangeCVE-2026-5260Fix available8.2 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +21 more +23 moreGnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handlingCVE-2026-42015Fix available5.3 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +21 more +23 moreGnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pinCVE-2026-42014Fix available6.6 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: certificate validation bypass due to oversized subject alternative nameCVE-2026-42013Fix available8.2 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +24 more +26 moreGnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sansCVE-2026-42012Fix available7.1 High
- gnu gnutls, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +46 more +48 moreGnutls: gnutls: denial of service via dtls packet reordering vulnerabilityCVE-2026-42009Fix available7.5 High
- pgjdbc, postgresql jdbc driver, red hat amq broker 7.13.6 +17 more +19 morepgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoSCVE-2026-42198Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreCockpit is vulnerable to directory traversalCVE-2026-38993Fix available6.5 Medium
- libsndfile project libsndfile, red hat ai inference server 3.3, enterprise linux 10 +14 more +16 moreAn issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was...CVE-2026-37555Fix available7.5 High
- coredns, red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.14 +1 more +3 moreCoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transportsCVE-2026-35579Fix available8.2 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Thunderbird 150.0.1CVE-2026-73247.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreMemory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1CVE-2026-7323Fix available7.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreMemory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1CVE-2026-7322Fix available7.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +16 more +18 moreInformation disclosure due to incorrect boundary conditions in the Audio/Video componentCVE-2026-7320Fix available7.5 High
- redhat openshift container platform, red hat openshift container platform 4 +1 moreOpenshift-controller-manager: openshift container platform: information disclosure via environment variable injectionCVE-2026-73094.3 Medium
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: C++ JSON OOB readCVE-2026-41607Fix available6.5 Medium
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: c_glib dispatch stack overflowCVE-2026-41606Fix available5.3 Medium
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: Swift Compact Protocol integer overflowCVE-2026-41605Fix available7.3 High
- apache thrift, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +12 more +14 moreApache Thrift: Swift Range crash in skip()CVE-2026-41604Fix available8.2 High
- apache thrift, red hat multicluster global hub, multicluster global hub 1.3.4 +17 more +19 moreApache Thrift: Go TFramedTransport uint32 overflowCVE-2026-41602Fix available7.5 High
- apache thrift, red hat cryostat 4 on rhel 9, multicluster global hub +16 more +18 moreApache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.CVE-2025-48431Fix available7.5 High
- spring boot, vmware spring boot, red hat amq broker 7 +14 more +16 moreSpring Boot's default security filter chain has no authorization rule with Actuator but without HealthCVE-2026-40976Fix available9.1 Critical
- spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 moreSpring Boot's random value property source uses a weak PRNG unsuitable for secretsCVE-2026-40975Fix available4.8 Medium
- apache camel, red hat build of apache camel for spring boot 4, fuse 7 +2 more +4 moreApache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV storeCVE-2026-27172Public exploitFix available8.8 High
- apache camel, red hat build of apache camel 4.18.1 for spring boot 3.5.14, fuse 7 +2 more +4 moreApache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code ExecutionCVE-2026-33453Public exploitFix available10.0 Critical
- apache camel, red hat build of apache camel - hawtio 4, build of apache camel 4 for quarkus 3 +8 more +10 moreApache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)CVE-2026-33454Public exploitFix available9.4 Critical
- apache camel, apache software foundation camel platform http main, red hat openshift serverless +7 more +9 moreApache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtimeCVE-2026-40022Public exploitFix available8.2 High
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation RepositoryCVE-2026-40858Public exploitFix available8.8 High
- apache camel, apache software foundation camel coap, camel google pubsub +10 more +12 moreApache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows ca…CVE-2026-40453Public exploitFix available9.9 Critical
- apache camel, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +4 more +6 moreApache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqpCVE-2026-40860Public exploitFix available9.8 Critical
- apache camel, apache software foundation camel pqc, red hat build of apache camel for spring boot 4 +2 moreApache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManagerCVE-2026-40048Public exploitFix available7.8 High
- apache camel, apache software foundation camel mina, red hat build of apache camel for spring boot 4 +1 more +3 moreApache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDPCVE-2026-40473Public exploitFix available8.8 High
- red hat advanced cluster management for kubernetes 2, winfsp +1 moreRace Condition VulnerabilityCVE-2026-30067.0 High
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +5 more +7 moreLiteLLM: Authenticated command execution via MCP stdio test endpointsCVE-2026-42271In KEVPublic exploitFix availableEPSS 91.4%8.7 High
- simple-git project simple-git, red hat enterprise linux 8, enterprise linux 9 +3 more +5 moresimple-git is vulnerable to Remote Code ExecutionCVE-2026-6951Public exploitFix available9.2 Critical
- katacontainers kata containers, kata-containers, katacontainers confidential containers +3 more +5 moreKata Containers: CopyFile Policy Subversion via SymlinksCVE-2026-41326Fix available8.2 High
- axios, red hat cryostat 4, gatekeeper 3 +61 more +63 moreAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataCVE-2026-42039Fix available6.9 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyCVE-2026-42041Fix available4.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +56 more +58 moreAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0CVE-2026-42043Fix available7.2 High
- axios, red hat cryostat 4, gatekeeper 3 +59 more +61 moreAxios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`CVE-2026-42044Fix available6.5 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033Fix available7.4 High
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: StripPrefixRegex auth bypass via Path/RawPath desyncCVE-2026-40912Fix available7.8 High
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: Forwarded alias spoofing top pre-auth decision bypassCVE-2026-39858Fix available7.8 High
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authCVE-2026-35051Fix available7.8 High
- berriai litellm, red hat lightspeed core, ansible automation platform 2 +1 more +3 moreLiteLLM: SQL injection in Proxy API key verificationCVE-2026-42208In KEVPublic exploitFix availableEPSS 89.4%9.3 Critical
- berriai litellm, red hat exploit intelligence, ansible automation platform 2 +1 more +3 moreLiteLLM: Server-Side Template Injection in /prompts/test endpointCVE-2026-42203Public exploitFix available8.6 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 morexfrm: hold dev ref until after transport_finish NF_HOOKCVE-2026-31663Fix available7.8 High
- linux, linux kernel, red hat enterprise linux 10 +4 more +6 morerxrpc: Fix RxGK token loading to check boundsCVE-2026-31641Fix available7.8 High
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 moreusb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()CVE-2026-31617Fix available5.5 Medium
- Show moreLoading…