Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreNetworkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)CVE-2026-19685Fix available7.1 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: notification backends allow ssrf and credential leakageCVE-2026-713667.7 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: project archive extraction allows path traversal file writesCVE-2026-713647.2 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpmbuild gettarspec() crafted tar member name → macro injectionCVE-2026-78367Fix available7.0 High
- the webkitgtk team webkitgtk, webkit, red hat enterprise linux 6 +13 more +15 moreWebkitgtk: use-after-free of jscvalue function parametersCVE-2026-78376Fix available8.8 High
- red hat certificate system 10, certificate system 11, enterprise linux 10 +4 more +6 moreJss: jss: jsstrustmanager does not verify nss trust flags on ca certificatesCVE-2026-78323Fix available6.5 Medium
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkCVE-2026-732677.7 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespaceCVE-2026-731377.7 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restrictionCVE-2026-675679.9 Critical
- red hat advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +1 moreLighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker labelCVE-2026-667889.9 Critical
- red hat advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +1 moreLighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addressesCVE-2026-667878.7 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijackCVE-2026-667858.7 High
- red hat openshift container platform 4, openshift container platform 5 +1 moreKata-containers: insufficient validation of createcontainer mount and storage rules in genpolicyCVE-2026-77176Fix available8.1 High
- red hat build of apache camel 3.33.3.sp2, build of apache camel 4 for quarkus 3, build of debezium 3 +12 more +14 moreWildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth foldingCVE-2026-196117.4 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreIpa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request valueCVE-2026-731996.5 Medium
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreFreeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationshipsCVE-2026-118619.6 Critical
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreIpa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body readCVE-2026-731987.5 High
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreIpa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastoreCVE-2026-130978.7 High
- freeipa, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreIpa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encodingCVE-2026-731964.3 Medium
- freeipa, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreIpa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body readCVE-2026-731977.5 High
- rpm-software-management popt, red hat enterprise linux 10, enterprise linux 6 +7 more +9 morePopt-devel: popt-static: short realloc in poptconfigfiletostringCVE-2026-18743Fix available2.5 Low
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +13 more +15 moreLibvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflowCVE-2026-18917Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreLibsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responsesCVE-2026-77014Fix available5.3 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreSearch-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)CVE-2026-768276.8 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentialsCVE-2026-761398.0 High
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreMce-operator-bundle: all github actions pinned by mutable tag, not commit shaCVE-2026-755697.7 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSearch-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestworkCVE-2026-704969.9 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreVolsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscriptionCVE-2026-188746.2 Medium
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreCluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public routeCVE-2026-667949.3 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating saCVE-2026-714709.1 Critical
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +2 more +4 moreCockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_htmlCVE-2026-76235Fix available7.5 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform expansion pack +10 more +12 moreModcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagramCVE-2026-761664.3 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 moreSwtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatchCVE-2026-75900Fix available6.1 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.6, data grid 8 +2 more +4 moreKeycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc clientCVE-2026-15571Fix available7.3 High
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSubmariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosityCVE-2026-667806.5 Medium
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner-operator: release workflow consumes same-org composite action via mutable @devel branch refCVE-2026-667834.4 Medium
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.16, advanced cluster management for kubernetes 2.17 +2 moreSubmariner-operator: operator clusterrole grants cluster-wide create/update on all configmapsCVE-2026-667825.8 Medium
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSubmariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authenticationCVE-2026-667815.4 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.15, build of keycloak 26.6 +11 more +13 moreKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassCVE-2026-18963Public exploitFix available9.1 Critical
- red hat multicluster engine for kubernetes, advanced cluster management for kubernetes 2 +1 moreManaged-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approvalCVE-2026-759248.7 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: webhook status callback ssrf leaks the git patCVE-2026-713657.7 High
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrfCVE-2026-125649.6 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMust-gather: /tmp/kubeconfig retentionCVE-2026-754855.5 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMust-gather: must-gather: embedded secret data in acm wrapper crs collected without redactionCVE-2026-738345.5 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreGovernance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spokeCVE-2026-667938.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreBluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folderCVE-2026-75032Fix available6.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policiesCVE-2026-196085.3 Medium
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreManagedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)CVE-2026-667959.9 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreAcm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_memCVE-2026-714729.1 Critical
- red hat advanced cluster management for kubernetes 2, advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13 +4 more +6 moreSearch-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:mastersCVE-2026-704958.8 High
- Show moreLoading…