Red Hat
7323 CVEs across 1331 Red Hat products. Browse Red Hat vulnerabilities, severities, and proof-of-concept exploits.
Red Hat products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-95520 | High | 7.1 | 2026-09-29 | A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFF… |
CVE-2026-102474 | Medium | 4.0 | 2026-09-29 | A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six byt… |
CVE-2026-102473 | Medium | 5.5 | 2026-09-29 | A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local… |
CVE-2026-97029 | Medium | 5.7 | 2026-09-29 | Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes outside the san… |
CVE-2026-97024 | High | 7.1 | 2026-09-29 | A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host syst… |
CVE-2026-97027 | Low | 3.6 | 2026-09-28 | Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files… |
CVE-2026-97026 | Low | 3.9 | 2026-09-28 | Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a permissive uma… |
CVE-2026-97025 | Low | 3.2 | 2026-09-28 | Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local user… |
CVE-2026-97023 | High | 7.1 | 2026-09-28 | A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of atta… |
CVE-2026-102010 | High | 7.0 | 2026-09-28 | A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fail… |
CVE-2026-96740 | Medium | 6.5 | 2026-09-28 | A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the conso… |
CVE-2026-87114 | High | 7.1 | 2026-09-28 | A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint inst… |
CVE-2026-101333 | Low | 3.7 | 2026-09-28 | A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue occurs when the… |
CVE-2026-86330 | High | 7.2 | 2026-09-28 | An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the M… |
CVE-2026-101292 | High | 8.2 | 2026-09-28 | Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Cla… |
CVE-2026-96284 | Low | 2.5 | 2026-09-27 | A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the… |
CVE-2026-96283 | Low | 3.3 | 2026-09-27 | By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, makin… |
CVE-2026-96282 | Low | 3.1 | 2026-09-27 | A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can b… |
CVE-2026-96281 | Medium | 6.2 | 2026-09-27 | On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote re… |
CVE-2026-96280 | High | 7.5 | 2026-09-27 | The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing und… |
CVE-2026-96279 | Medium | 6.5 | 2026-09-27 | A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remo… |
CVE-2026-93834 | High | 8.8 | 2026-09-25 | A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcr… |
CVE-2026-96448 | Medium | 6.6 | 2026-09-25 | A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the sys… |
CVE-2026-97846 | Medium | 6.8 | 2026-09-25 | Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding… |
CVE-2026-90959 | High | 8.1 | 2026-09-24 | A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges t… |
CVE-2026-95521 | High | 7.8 | 2026-09-24 | A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm t… |
CVE-2026-95519 | High | 7.8 | 2026-09-24 | A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-proc… |
CVE-2026-94416 | Medium | 6.8 | 2026-09-24 | An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new servi… |
CVE-2026-97311 | Medium | 4.3 | 2026-09-24 | A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specifi… |
CVE-2026-97185 | High | 7.8 | 2026-09-24 | A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing… |
CVE-2026-97177 | Medium | 6.6 | 2026-09-24 | A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for sp… |
CVE-2026-97176 | Medium | 4.2 | 2026-09-24 | A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client s… |
CVE-2026-75887 | High | 7.5 | 2026-09-23 | A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query para… |
CVE-2026-75886 | High | 7.2 | 2026-09-23 | A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authenticat… |
CVE-2026-96889 | High | 7.8 | 2026-09-23 | A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free… |
CVE-2026-85475 | High | 7.2 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-cont… |
CVE-2026-84724 | Medium | 6.6 | 2026-09-23 | An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint sto… |
CVE-2026-84721 | Medium | 6.4 | 2026-09-23 | A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the… |
CVE-2026-84720 | Medium | 6.5 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged… |
CVE-2026-84719 | Critical | 9.9 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates o… |
CVE-2026-84718 | Medium | 4.3 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X… |
CVE-2026-84717 | Medium | 5.3 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature veri… |
CVE-2026-84716 | Medium | 6.6 | 2026-09-23 | A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an ex… |
CVE-2026-84714 | High | 7.1 | 2026-09-23 | A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expres… |
CVE-2026-84713 | Medium | 6.5 | 2026-09-23 | A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configura… |
CVE-2026-84712 | Medium | 5.3 | 2026-09-23 | A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView… |
CVE-2026-84706 | High | 7.6 | 2026-09-23 | A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names agai… |
CVE-2026-84691 | High | 8.7 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an adm… |
CVE-2026-84683 | High | 8.7 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update st… |
CVE-2026-75884 | Critical | 9.1 | 2026-09-23 | A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing in… |
CVE-2026-96546 | Low | 2.5 | 2026-09-23 | A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in pe… |
CVE-2026-96545 | Medium | 4.4 | 2026-09-23 | An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the fi… |
CVE-2026-96541 | High | 7.5 | 2026-09-23 | A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and re… |
CVE-2026-84502 | Critical | 9.9 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a d… |
CVE-2026-84499 | High | 7.7 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displa… |
CVE-2026-84486 | High | 8.2 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow sch… |
CVE-2026-84474 | Critical | 9.9 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holdin… |
CVE-2026-76648 | High | 8.5 | 2026-09-23 | CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler… |
CVE-2026-71465 | Low | 3.1 | 2026-09-23 | RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like… |
CVE-2026-71464 | Low | 3.1 | 2026-09-23 | LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch… |
CVE-2026-71463 | Low | 2.7 | 2026-09-23 | Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job… |
CVE-2026-71462 | Medium | 4.1 | 2026-09-23 | StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existe… |
CVE-2026-71461 | Medium | 4.3 | 2026-09-23 | HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldEr… |
CVE-2026-71460 | Medium | 4.3 | 2026-09-23 | /api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, i… |
CVE-2026-71459 | Medium | 5.0 | 2026-09-23 | JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns Tr… |
CVE-2026-71458 | Medium | 5.0 | 2026-09-23 | URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 4… |
CVE-2026-88840 | Medium | 5.3 | 2026-09-23 | BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. |
CVE-2026-88839 | Medium | 6.7 | 2026-09-23 | BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. |
CVE-2026-88837 | Medium | 6.5 | 2026-09-23 | BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. |
CVE-2026-88835 | Medium | 6.1 | 2026-09-23 | BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. |
CVE-2026-88831 | Medium | 5.3 | 2026-09-23 | BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. |
CVE-2026-88832 | High | 7.3 | 2026-09-23 | BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images. |
CVE-2026-88830 | High | 7.5 | 2026-09-23 | A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExch… |
CVE-2026-96276 | Medium | 6.5 | 2026-09-23 | If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extensi… |
CVE-2026-96275 | High | 8.8 | 2026-09-23 | A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On… |
CVE-2026-96512 | High | 7.8 | 2026-09-23 | A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indic… |
CVE-2026-96446 | Medium | 4.2 | 2026-09-23 | A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used… |
CVE-2026-96445 | Medium | 6.8 | 2026-09-23 | A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates speci… |
CVE-2026-96442 | High | 7.8 | 2026-09-23 | A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary co… |
CVE-2026-13087 | High | 8.8 | 2026-09-22 | A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a craft… |
CVE-2026-94640 | High | 7.5 | 2026-09-22 | A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of uniqu… |
CVE-2026-90462 | Medium | 5.4 | 2026-09-22 | A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the… |
CVE-2026-95619 | High | 7.7 | 2026-09-22 | A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability co… |
CVE-2026-95508 | High | 7.4 | 2026-09-22 | A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-su… |
CVE-2026-95503 | Medium | 6.8 | 2026-09-22 | A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication… |
CVE-2026-93433 | Medium | 5.5 | 2026-09-21 | A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System… |
CVE-2026-92382 | Medium | 4.1 | 2026-09-21 | An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer per… |
CVE-2026-94449 | High | 7.5 | 2026-09-21 | A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. T… |
CVE-2026-94184 | High | 8.1 | 2026-09-21 | A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication… |
CVE-2026-80110 | High | 8.1 | 2026-09-21 | A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string c… |
CVE-2026-75939 | High | 7.4 | 2026-09-21 | A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors befo… |
CVE-2026-94368 | High | 7.1 | 2026-09-21 | A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the serv… |
CVE-2026-92574 | High | 8.8 | 2026-09-21 | A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes sec… |
CVE-2026-15801 | High | 8.0 | 2026-09-21 | A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint arch… |
CVE-2026-94218 | Low | 3.1 | 2026-09-21 | A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enfor… |
CVE-2026-94217 | Low | 3.5 | 2026-09-21 | A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission t… |
CVE-2026-94215 | Medium | 5.5 | 2026-09-21 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request… |
CVE-2026-94213 | Medium | 4.9 | 2026-09-21 | A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy ev… |
CVE-2026-94001 | Medium | 6.5 | 2026-09-19 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials doe… |
CVE-2026-94000 | Medium | 6.6 | 2026-09-19 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints… |