Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.6 +3 more +5 moreKeycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest apiCVE-2026-17048Fix available5.5 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreAccountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed usersCVE-2026-167435.5 Medium
- red hat enterprise linux 10, enterprise linux 9, hardened images +3 more +5 moreDbus-broker: dbus-broker: session bus denial of service via emfile during peer setupCVE-2026-16730Fix available5.5 Medium
- red hat openshift update service, quay 3 +1 moreQuay: ssrf in red hat quay notification webhooks (slack/generic)CVE-2026-169105.5 Medium
- red hat certificate system 9, enterprise linux 10, enterprise linux 8 +1 more +3 moreRhcs: memory leak during https connection leads to denial of serviceCVE-2026-123535.3 Medium
- gnome gdk-pixbuf, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreGdk-pixbuf: out-of-bounds read in ico parserCVE-2026-167685.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreLibcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()CVE-2026-646117.5 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +2 moreOdh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validationCVE-2026-167458.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreNano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.CVE-2026-6390Fix available6.8 Medium
- gnome librest, red hat enterprise linux 10, enterprise linux 10.0 extended update support +2 moreLibrest: weak random number generation in pkce implementationCVE-2026-16615Fix available6.8 Medium
- red hat directory server 11, directory server 12, directory server 13 +5 more +7 more389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdnCVE-2026-165605.3 Medium
- red hat ansible automation platform 2Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settingsCVE-2026-441917.8 High
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api keyCVE-2026-441873.3 Low
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversalCVE-2026-441926.6 Medium
- red hat ansible automation platform 2Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script settingCVE-2026-441907.8 High
- red hat ansible automation platform 2Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filenameCVE-2026-441897.8 High
- red hat ansible automation platform 2Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosureCVE-2026-165446.5 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreSbc: sbc: heap out-of-bounds read via crafted sbc audio frameCVE-2026-16473Fix available4.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreLibarchive: libarchive: signed integer overflow in archive_write_zip_headerCVE-2026-16517Fix available2.9 Low
- gnome libsoup, red hat enterprise linux 10, redhat enterprise linux +2 moreLibsoup: heap out-of-bounds read in libsoup due to integer truncationCVE-2026-12548Fix available4.2 Medium
- red hat enterprise linux 10Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switchCVE-2026-12547Fix available3.4 Low
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +4 more +6 moreAnsible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)CVE-2026-16493Fix available7.8 High
- libssh, red hat enterprise linux 10, enterprise linux 8 +11 more +13 moreLibssh: libssh: authentication bypass via missing gssapi principal checkCVE-2026-59851Fix available8.8 High
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: use-after-free via data callbacks on closed channelsCVE-2026-59850Fix available4.3 Medium
- libssh, red hat enterprise linux 10, enterprise linux 8 +11 more +13 moreLibssh: libssh: denial of service via automatic certificate authentication loopCVE-2026-59849Fix available3.1 Low
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: denial of service via sftp responses with unknown request idsCVE-2026-59848Fix available5.3 Medium
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: integrity downgrade via openssl aes-gcm tag verificationCVE-2026-59847Fix available5.9 Medium
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: information disclosure via proxycommand %r username expansionCVE-2026-59846Fix available3.9 Low
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreRpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formattingCVE-2026-16461Fix available6.5 Medium
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: denial of service via oversized sftp read lengthCVE-2026-59844Fix available6.5 Medium
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: denial of service via unchecked proxycommand fork() failureCVE-2026-59845Fix available5.3 Medium
- libssh, red hat enterprise linux 10, enterprise linux 8 +3 more +5 moreLibssh: libssh: denial of service via zero advertised channel packet sizeCVE-2026-59843Fix available6.5 Medium
- libssh, red hat enterprise linux 10, enterprise linux 8 +11 more +13 moreLibssh: libssh: information disclosure via short gssapi curve25519 public keyCVE-2026-59842Fix available3.7 Low
- libssh, red hat enterprise linux 10, enterprise linux 8 +11 more +13 moreLibssh: libssh: stack buffer overflow in sftp server longname constructionCVE-2026-15370Fix available6.7 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreKronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic linksCVE-2026-15812Fix available4.8 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreKronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changesCVE-2026-15811Fix available5.8 Medium
- red hat mirror registry for red hat openshift 2, quay 3.10, quay 3.12 +5 more +7 moreQuay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validationCVE-2026-159276.8 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreLibcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed pngCVE-2026-64612Fix available7.5 High
- red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9 +10 more +12 morePulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexportCVE-2026-127019.0 Critical
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreRpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()CVE-2026-16277Fix available6.5 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.19 +29 more +31 moreGdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line bufferingCVE-2026-15588Fix available5.3 Medium
- red hat advanced cluster security 4, quay 3 +1 moreClaircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parserCVE-2026-162544.3 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreKronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentationCVE-2026-15813Fix available6.5 Medium
- red hat logging subsystem for red hat openshift, multicluster engine for kubernetes, multicluster engine for kubernetes 2.1 +17 more +19 moreHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesCVE-2026-162429.4 Critical
- xdg xdgmime, red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18 +22 more +24 moreXdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.cCVE-2026-16118Fix available7.1 High
- redhat build of keycloak, red hat build of keycloak 26.6, build of keycloak 26.6.7 +3 more +5 moreKeycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only adminsCVE-2026-16104Fix available4.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemptionCVE-2026-161034.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child rolesCVE-2026-16106Fix available4.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2CVE-2026-16108Fix available4.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +5 more +7 moreKeycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headersCVE-2026-16093Fix available5.4 Medium
- Show moreLoading…