Red Hat
1811 CVEs across 709 Red Hat products. Browse Red Hat vulnerabilities, severities, and proof-of-concept exploits.
Red Hat products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-74247 | Medium | 4.2 | 2026-08-14 | A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-74245 | Medium | 5.9 | 2026-08-14 | A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper a… |
CVE-2026-74244 | Medium | 5.9 | 2026-08-14 | A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending cra… |
CVE-2026-74243 | Medium | 6.5 | 2026-08-14 | A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the… |
CVE-2026-74242 | Medium | 5.3 | 2026-08-14 | A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can… |
CVE-2026-74241 | Medium | 4.8 | 2026-08-14 | A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during auth… |
CVE-2026-74240 | Medium | 5.4 | 2026-08-14 | A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues relate… |
CVE-2026-13002 | Medium | 4.4 | 2026-08-14 | A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dns… |
CVE-2026-58224 | Medium | 6.5 | 2026-08-14 | A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malf… |
CVE-2026-19879 | Medium | 5.3 | 2026-08-14 | A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16… |
CVE-2026-19617 | Medium | 5.5 | 2026-08-14 | A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This cou… |
CVE-2026-19730 | Medium | 4.2 | 2026-08-13 | The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy atte… |
CVE-2026-73266 | High | 7.1 | 2026-08-13 | A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating… |
CVE-2026-73585 | Medium | 6.3 | 2026-08-13 | A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlin… |
CVE-2026-73584 | Medium | 6.3 | 2026-08-13 | A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary… |
CVE-2026-73583 | Medium | 6.6 | 2026-08-13 | A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-… |
CVE-2026-18728 | Medium | 6.5 | 2026-08-13 | A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (D… |
CVE-2026-71846 | Medium | 6.5 | 2026-08-12 | A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, w… |
CVE-2026-71473 | High | 8.5 | 2026-08-12 | A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that a… |
CVE-2026-71471 | Critical | 9.0 | 2026-08-12 | A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Res… |
CVE-2026-71469 | High | 7.5 | 2026-08-12 | A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates… |
CVE-2026-18727 | Medium | 6.5 | 2026-08-12 | A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration… |
CVE-2026-18726 | Medium | 6.5 | 2026-08-12 | A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiui… |
CVE-2026-19654 | High | 7.5 | 2026-08-12 | A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery c… |
CVE-2026-19130 | Medium | 5.8 | 2026-08-12 | A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and kn… |
CVE-2026-13622 | High | 8.8 | 2026-08-12 | A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the targe… |
CVE-2026-73434 | Medium | 6.1 | 2026-08-12 | A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries i… |
CVE-2026-73433 | Medium | 6.6 | 2026-08-12 | A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaini… |
CVE-2026-73269 | Critical | 9.9 | 2026-08-12 | A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigge… |
CVE-2026-73268 | Critical | 9.9 | 2026-08-12 | A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resourc… |
CVE-2026-72508 | Critical | 9.9 | 2026-08-12 | A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin… |
CVE-2026-19548 | Medium | 5.5 | 2026-08-12 | Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root… |
CVE-2026-18663 | Medium | 5.9 | 2026-08-12 | A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection… |
CVE-2026-73122 | High | 7.7 | 2026-08-12 | A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent fr… |
CVE-2026-72526 | Critical | 9.9 | 2026-08-12 | A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Applic… |
CVE-2026-70398 | Critical | 9.6 | 2026-08-12 | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, refer… |
CVE-2026-66878 | High | 7.7 | 2026-08-12 | A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription r… |
CVE-2026-64927 | Medium | 6.4 | 2026-08-12 | A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles… |
CVE-2026-19550 | Medium | 4.3 | 2026-08-11 | A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permissi… |
CVE-2026-71845 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credent… |
CVE-2026-71475 | Medium | 5.0 | 2026-08-11 | A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This oc… |
CVE-2026-71474 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com p… |
CVE-2026-71468 | Medium | 5.3 | 2026-08-11 | A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all su… |
CVE-2026-71467 | High | 7.5 | 2026-08-11 | A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upg… |
CVE-2026-19546 | High | 8.8 | 2026-08-11 | A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation pl… |
CVE-2026-19078 | Medium | 4.3 | 2026-08-11 | A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly… |
CVE-2026-14180 | Medium | 5.3 | 2026-08-11 | A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issu… |
CVE-2026-50237 | High | 7.4 | 2026-08-11 | A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepos… |
CVE-2026-50236 | High | 7.4 | 2026-08-11 | An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation… |
CVE-2026-72694 | High | 7.1 | 2026-08-11 | A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symb… |
CVE-2026-72693 | High | 7.8 | 2026-08-11 | `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/… |
CVE-2026-71218 | Medium | 5.3 | 2026-08-11 | A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled messag… |
CVE-2026-71217 | High | 7.5 | 2026-08-11 | A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as… |
CVE-2026-15567 | High | 7.5 | 2026-08-11 | A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled lengt… |
CVE-2026-15565 | High | 7.5 | 2026-08-11 | A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any… |
CVE-2026-15563 | High | 7.4 | 2026-08-11 | A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and… |
CVE-2026-15562 | High | 7.5 | 2026-08-11 | A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting ha… |
CVE-2026-15561 | High | 7.5 | 2026-08-11 | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connec… |
CVE-2026-15560 | High | 8.1 | 2026-08-11 | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthent… |
CVE-2026-15556 | High | 8.1 | 2026-08-11 | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker… |
CVE-2026-15555 | High | 8.8 | 2026-08-11 | A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshalle… |
CVE-2026-15554 | High | 7.4 | 2026-08-11 | the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated… |
CVE-2026-10579 | Critical | 9.8 | 2026-08-11 | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting a… |
CVE-2026-19519 | Medium | 4.3 | 2026-08-11 | A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. T… |
CVE-2026-19391 | Medium | 6.5 | 2026-08-11 | A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows… |
CVE-2026-24330 | Medium | 6.5 | 2026-08-11 | A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted so… |
CVE-2026-24329 | Medium | 4.9 | 2026-08-11 | A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the… |
CVE-2026-6426 | Medium | 4.4 | 2026-08-10 | A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by th… |
CVE-2026-63622 | High | 7.8 | 2026-08-10 | A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in… |
CVE-2026-19411 | Low | 3.9 | 2026-08-10 | A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of se… |
CVE-2026-18982 | High | 8.8 | 2026-08-10 | A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate the… |
CVE-2026-18951 | High | 8.8 | 2026-08-10 | A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs` management permiss… |
CVE-2026-18950 | High | 8.8 | 2026-08-10 | A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does… |
CVE-2026-18949 | High | 8.8 | 2026-08-10 | A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly bro… |
CVE-2026-18948 | Critical | 9.9 | 2026-08-10 | A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' libra… |
CVE-2026-18947 | High | 8.5 | 2026-08-10 | A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially craf… |
CVE-2026-18942 | Medium | 5.5 | 2026-08-10 | A flaw was found in the Feast operator. A malicious tenant could inject arbitrary code into their feature repository. This code would be executed by an automat… |
CVE-2026-18941 | High | 7.7 | 2026-08-10 | A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager… |
CVE-2026-18621 | High | 7.6 | 2026-08-10 | A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Wor… |
CVE-2026-18620 | High | 7.1 | 2026-08-10 | A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount f… |
CVE-2026-18618 | High | 7.5 | 2026-08-10 | A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issu… |
CVE-2026-18617 | High | 8.8 | 2026-08-10 | A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, wh… |
CVE-2026-18611 | High | 7.5 | 2026-08-10 | A flaw was found in the Data Science Pipelines Operator. This vulnerability allows an unauthenticated attacker to derive sensitive credentials, such as MariaDB… |
CVE-2026-18608 | High | 8.7 | 2026-08-10 | A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond… |
CVE-2026-16456 | Medium | 6.5 | 2026-08-10 | A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create custom resources can exploit a vulnerability in the `loadSecre… |
CVE-2026-15581 | High | 8.0 | 2026-08-10 | A flaw was found in the TrustyAI Service (TAS) deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly acces… |
CVE-2026-15467 | High | 8.1 | 2026-08-10 | A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configurin… |
CVE-2026-14450 | Critical | 9.9 | 2026-08-10 | A flaw was found in the MaaS API. This vulnerability allows any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers, speci… |
CVE-2026-13717 | High | 8.8 | 2026-08-10 | A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with… |
CVE-2026-59091 | High | 7.3 | 2026-08-10 | A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user… |
CVE-2026-71577 | Medium | 6.3 | 2026-08-10 | A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communica… |
CVE-2026-71576 | High | 8.5 | 2026-08-10 | A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A r… |
CVE-2026-63623 | Medium | 5.5 | 2026-08-10 | A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by… |
CVE-2026-59090 | High | 8.4 | 2026-08-10 | A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a sp… |
CVE-2026-19278 | Medium | 6.8 | 2026-08-10 | A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses… |
CVE-2026-59088 | Medium | 5.5 | 2026-08-10 | A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorr… |
CVE-2026-59087 | High | 7.8 | 2026-08-10 | A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerabil… |
CVE-2026-19404 | Medium | 6.5 | 2026-08-10 | A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, all… |
CVE-2026-19389 | High | 7.1 | 2026-08-10 | Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from cr… |
CVE-2026-19387 | High | 7.6 | 2026-08-10 | A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation… |