Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Thunderbird 151CVE-2026-89738.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreSame-origin policy bypass in the DOM: Networking componentCVE-2026-89489.1 Critical
- mozilla firefox, firefox focus, red hat enterprise linux 10 +4 more +6 moreSandbox escape in Firefox and Firefox Focus for AndroidCVE-2026-89457.5 High
- apache camel, red hat openshift serverless, build of apache camel 4 for quarkus 3 +4 more +6 moreApache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringCVE-2026-47323Public exploitFix availableEPSS 19.6%9.8 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: access token disclosure and implicit flow bypass via forged client dataCVE-2026-7571Fix available7.1 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeoverCVE-2026-7507Fix available7.5 High
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +2 more +4 moreOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloakCVE-2026-7504Fix available8.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replayCVE-2026-37982Fix available6.8 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypassCVE-2026-37979Fix available6.5 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin apiCVE-2026-37978Fix available4.9 Medium
- red hat build of keycloak 26.2, build of keycloak 26.2.16, build of keycloak 26.4 +7 more +9 moreKeycloak: keycloak: denial of service via specially crafted saml inputCVE-2026-7307Fix available7.5 High
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpointCVE-2026-37981Fix available4.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.12, redhat build of keycloak +2 moreKeycloak: keycloak: unauthorized resource access and data modification via insecure direct object referenceCVE-2026-4630Fix available6.8 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreImproper Origin Validation in mlflow/mlflowCVE-2026-2611Fix available9.6 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-servicesCVE-2026-89225.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.6 +2 more +4 moreKeycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulationCVE-2026-8830Fix available4.3 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreMemory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151CVE-2026-8975Fix available8.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreUse-after-free in the DOM: Bindings (WebIDL) componentCVE-2026-8947Fix available7.3 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +15 more +17 moreIncorrect boundary conditions in the Audio/Video: Web Codecs componentCVE-2026-8946Fix available7.5 High
- red hat ansible automation platform 2, openstack platform 18.0, quay 3 +1 more +3 moreAPScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure DeserializationCVE-2026-310729.8 Critical
- red hat openshift ai (rhoai)ModelScope is vulnerable to arbitrary code injection via a crafted moduleCVE-2025-51427Fix available7.3 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick: Use-After-Free in MSL decoder.CVE-2026-46523Fix available6.2 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustionCVE-2026-46522Public exploitFix available7.5 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensionsCVE-2026-46520Fix available7.5 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick: Policy Bypass in MNG coder couldCVE-2026-45664Fix available5.3 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 extended lifecycle support +2 moreImageMagick: Policy Bypass in PSD decoderCVE-2026-45031Fix available5.3 Medium
- imagemagick, red hat enterprise linux 6, enterprise linux 7 +2 moreImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top defineCVE-2026-45359Fix available5.7 Medium
- docker engine, moby docker engine, docker docker/daemon +20 more +22 moreDocker: `PUT /containers/{id}/archive` executes container binary on the hostCVE-2026-41567Public exploitFix available7.2 High
- hamba avro, red hat cryostat 4 on rhel 9, multicluster global hub 1.4.5 +11 more +13 moreiskorotkov/avro: CPU Exhaustion in Avro DecoderCVE-2026-46385Fix available8.7 High
- hamba avro, red hat cryostat 4 on rhel 9, multicluster global hub 1.4.5 +11 more +13 moreiskorotkov/avro: Integer Overflow in Avro DecoderCVE-2026-46384Fix available8.7 High
- chroma chromadb, red hat enterprise linux ai (rhel ai) 3 +1 moreChromaDB Python project has a pre-authentication code injection vulnerabilityCVE-2026-45829Public exploitEPSS 15.1%10.0 Critical
- vim, red hat enterprise linux 10, enterprise linux 10.2 extended update support +9 more +11 moreVim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code executionCVE-2026-43961Fix available7.8 High
- jsonpickle python jsonpickle, red hat ansible automation platform 2 +1 morepython jsonpickle 2.0.0 Remote Code Execution via py/reprCVE-2021-479529.3 Critical
- debian linux, linux kernel, red hat nvidia for rhel 10 +25 more +27 moreptrace: slightly saner 'get_dumpable()' logicCVE-2026-46333Public exploitFix available7.1 High
- amd epyc™ 7002 series processors, epyc™ embedded 7002 series processors, ryzen embedded v2000a series processors +31 more +33 moreImproper isolation of shared resources within the CPU operation cache on Zen 2-based products...CVE-2025-54518Fix available7.3 High
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +2 moreA buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools...CVE-2026-34253Fix available8.2 High
- cesnet libyang, red hat enterprise linux 10, enterprise linux 10.0 extended update support +11 more +13 morelibyang: lyb_read_string() integer overflow → heap buffer overflowCVE-2026-44673Fix available7.5 High
- svelte, red hat build of podman desktop +1 moreSvelte: XSS via DOM Clobbering of Internal Framework StateCVE-2026-42573Fix available5.3 Medium
- svelte devalue, red hat build of podman desktop, enterprise linux 10 +1 more +3 moreSvelte devalue: DoS via sparse array deserializationCVE-2026-42570Fix available7.5 High
- apostrophecms sanitize-html, red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +27 more +29 moreApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`CVE-2026-44990Fix available9.3 Critical
- io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 moreopentelemetry-java: Unbounded Memory Allocation in W3C Baggage PropagationCVE-2026-45292Fix available5.3 Medium
- postgresql, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 morePostgreSQL discloses MD5-hashed passwords via covert timing channelCVE-2026-6478Fix available6.5 Medium
- postgresql, red hat discovery 2, enterprise linux 10 +17 more +19 morePostgreSQL libpq lo_* functions let server superuser overwrite client stack memoryCVE-2026-6477Fix available8.8 High
- postgresql, red hat ansible automation platform 2.2, enterprise linux 10 +16 more +18 morePostgreSQL server undersizes allocations, via integer wraparoundCVE-2026-6473Fix available8.8 High
- linux kernel, linux, red hat nvidia for rhel 10 +38 more +40 morenet: skbuff: preserve shared-frag marker during coalescingCVE-2026-46300In KEVPublic exploitFix availableEPSS 16.1%7.8 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox Breakout Using Async GeneratorCVE-2026-45411Fix available9.8 Critical
- traefik, red hat openshift dev spaces 3.29, openshift gitops +2 moreTraefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=falseCVE-2026-44774Fix available6.4 Medium
- sebhildebrandt systeminformation, red hat cryostat 4, multicluster engine for kubernetes +4 more +6 moresysteminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile nameCVE-2026-44724Fix available7.8 High
- f5 nginx open source, nginx plus, dos +26 more +28 moreNGINX ngx_http_rewrite_module vulnerabilityCVE-2026-42945Public exploitFix availableEPSS 68.0%9.2 Critical
- microsoft .net, .net 10.0, .net 8.0 +11 more +13 more.NET Elevation of Privilege VulnerabilityCVE-2026-35433Fix available7.3 High
- Show moreLoading…