Red Hat
Page 2 of 19 — Red Hat CVEs from a corpus of 1811, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42170 | High | 7.8 | 2026-08-08 | A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but se… |
CVE-2026-61477 | Low | 2.3 | 2026-08-07 | An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value at… |
CVE-2026-15816 | High | 7.5 | 2026-08-07 | A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without prope… |
CVE-2026-18938 | Medium | 6.2 | 2026-08-07 | A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By se… |
CVE-2026-19079 | Medium | 4.4 | 2026-08-07 | A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfile… |
CVE-2026-7867 | High | 7.8 | 2026-08-06 | A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org… |
CVE-2026-18649 | High | 7.5 | 2026-08-06 | A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on t… |
CVE-2026-18967 | Medium | 6.4 | 2026-08-06 | A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated… |
CVE-2026-18839 | Low | 2.2 | 2026-08-05 | An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an ap… |
CVE-2026-44605 | Medium | 5.5 | 2026-08-05 | A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted N… |
CVE-2026-49331 | Medium | 6.5 | 2026-08-05 | A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-regex), the proxy forwards client-supplied identity headers… |
CVE-2026-16442 | High | 7.4 | 2026-08-05 | A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the Id… |
CVE-2026-15572 | High | 8.8 | 2026-08-05 | A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which… |
CVE-2026-16102 | High | 8.1 | 2026-08-05 | A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to pr… |
CVE-2026-16100 | Medium | 6.5 | 2026-08-05 | A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operation… |
CVE-2026-16071 | Medium | 5.4 | 2026-08-05 | A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegat… |
CVE-2026-15573 | High | 8.1 | 2026-08-05 | A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properl… |
CVE-2026-16443 | High | 7.4 | 2026-08-05 | A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build… |
CVE-2026-71227 | Medium | 5.1 | 2026-08-05 | A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled… |
CVE-2026-71226 | High | 7.3 | 2026-08-05 | Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later… |
CVE-2026-71225 | Medium | 6.5 | 2026-08-05 | A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cip… |
CVE-2026-10090 | Critical | 9.0 | 2026-08-05 | A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM)… |
CVE-2026-10059 | Critical | 9.1 | 2026-08-05 | A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this… |
CVE-2026-18103 | Medium | 4.9 | 2026-08-05 | A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not… |
CVE-2026-68743 | Medium | 5.5 | 2026-08-04 | A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer siz… |
CVE-2026-70368 | Medium | 6.5 | 2026-08-04 | A stack-based out-of-bounds read vulnerability exists in the "s_vlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attac… |
CVE-2026-70367 | Medium | 5.4 | 2026-08-04 | A Server-Side Request Forgery (SSRF) bypass vulnerability exists in “stunnel” 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to… |
CVE-2026-68744 | Low | 3.3 | 2026-08-04 | A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink… |
CVE-2026-18739 | Low | 2.5 | 2026-08-04 | A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host applicatio… |
CVE-2026-18569 | Low | 3.7 | 2026-08-04 | A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles… |
CVE-2026-42169 | High | 7.3 | 2026-08-04 | A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, le… |
CVE-2026-17614 | Medium | 4.4 | 2026-08-04 | A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-… |
CVE-2026-18477 | Medium | 4.4 | 2026-08-03 | A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a director… |
CVE-2026-18651 | Medium | 5.4 | 2026-08-03 | A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account… |
CVE-2026-18508 | Medium | 4.4 | 2026-08-03 | A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level director… |
CVE-2026-68742 | Medium | 5.5 | 2026-08-03 | A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body… |
CVE-2026-6695 | Medium | 5.5 | 2026-08-03 | A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This… |
CVE-2026-6694 | Medium | 5.5 | 2026-08-03 | A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containi… |
CVE-2026-18573 | Medium | 6.5 | 2026-08-02 | A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a rea… |
CVE-2026-18572 | Medium | 6.5 | 2026-08-02 | Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access du… |
CVE-2026-18571 | Medium | 6.6 | 2026-08-02 | A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator… |
CVE-2026-18570 | Medium | 5.4 | 2026-08-02 | A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security… |
CVE-2026-18141 | High | 8.2 | 2026-07-31 | A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual… |
CVE-2026-18358 | High | 7.5 | 2026-07-31 | A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming conne… |
CVE-2026-15722 | High | 7.5 | 2026-07-31 | A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters… |
CVE-2026-11770 | High | 7.5 | 2026-07-31 | A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check exten… |
CVE-2026-10079 | High | 8.5 | 2026-07-31 | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata… |
CVE-2026-18218 | Medium | 4.2 | 2026-07-31 | A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific appl… |
CVE-2026-18217 | Low | 3.4 | 2026-07-31 | A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handle… |
CVE-2026-18215 | Medium | 6.8 | 2026-07-31 | Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where… |
CVE-2026-18214 | Medium | 6.8 | 2026-07-31 | Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where… |
CVE-2026-18211 | Medium | 4.2 | 2026-07-31 | A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requireme… |
CVE-2026-18209 | Low | 3.4 | 2026-07-31 | A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the securit… |
CVE-2026-18208 | Medium | 6.5 | 2026-07-31 | A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solutio… |
CVE-2026-18206 | Low | 3.7 | 2026-07-31 | A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administ… |
CVE-2026-18203 | Medium | 6.5 | 2026-07-31 | A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions… |
CVE-2026-16105 | Medium | 4.9 | 2026-07-31 | A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properl… |
CVE-2026-18157 | High | 7.8 | 2026-07-31 | A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in… |
CVE-2026-68563 | Medium | 5.5 | 2026-07-30 | A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is… |
CVE-2026-68562 | Medium | 6.2 | 2026-07-30 | A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When… |
CVE-2026-58222 | High | 8.8 | 2026-07-30 | A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processin… |
CVE-2026-58216 | Medium | 5.3 | 2026-07-30 | An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-enc… |
CVE-2026-58218 | Medium | 5.3 | 2026-07-30 | A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A rem… |
CVE-2026-18382 | Medium | 6.8 | 2026-07-30 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary… |
CVE-2026-18381 | High | 7.6 | 2026-07-30 | A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the… |
CVE-2026-18378 | High | 7.6 | 2026-07-30 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary u… |
CVE-2026-18369 | Medium | 5.8 | 2026-07-30 | A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects… |
CVE-2026-16531 | Medium | 5.3 | 2026-07-30 | An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary… |
CVE-2026-16530 | Medium | 6.5 | 2026-07-30 | A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sendi… |
CVE-2026-16529 | High | 7.5 | 2026-07-30 | A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permane… |
CVE-2026-16527 | High | 7.3 | 2026-07-30 | An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overw… |
CVE-2026-16526 | High | 8.8 | 2026-07-30 | A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privilege… |
CVE-2026-16524 | High | 7.8 | 2026-07-30 | A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets… |
CVE-2026-18255 | High | 7.2 | 2026-07-29 | A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allo… |
CVE-2026-18220 | High | 7.8 | 2026-07-29 | An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps E… |
CVE-2026-18207 | Medium | 6.5 | 2026-07-29 | A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique i… |
CVE-2026-18201 | Medium | 5.5 | 2026-07-29 | Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permis… |
CVE-2026-18107 | High | 7.8 | 2026-07-28 | A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq crit… |
CVE-2026-16313 | High | 7.6 | 2026-07-28 | A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control charact… |
CVE-2026-49332 | High | 8.5 | 2026-07-28 | A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip und… |
CVE-2026-18047 | Medium | 6.5 | 2026-07-28 | A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints… |
CVE-2026-17072 | Low | 3.3 | 2026-07-28 | A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Mat… |
CVE-2026-66759 | High | 7.1 | 2026-07-27 | A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer wi… |
CVE-2026-66758 | High | 7.8 | 2026-07-27 | A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers… |
CVE-2026-66757 | Medium | 5.5 | 2026-07-27 | A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dim… |
CVE-2026-12383 | High | 7.5 | 2026-07-27 | A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authe… |
CVE-2026-15003 | Medium | 5.6 | 2026-07-27 | A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a s… |
CVE-2026-17527 | High | 7.7 | 2026-07-27 | In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule g… |
CVE-2026-17523 | High | 7.8 | 2026-07-27 | A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code wi… |
CVE-2026-66339 | Medium | 6.5 | 2026-07-24 | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subseq… |
CVE-2026-66338 | Medium | 5.4 | 2026-07-24 | A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC… |
CVE-2026-66337 | Medium | 6.5 | 2026-07-24 | A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing mu… |
CVE-2026-17107 | High | 8.5 | 2026-07-24 | A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE)… |
CVE-2026-17039 | Low | 3.1 | 2026-07-24 | A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path… |
CVE-2026-17059 | Medium | 6.5 | 2026-07-24 | A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management soluti… |
CVE-2026-17048 | Medium | 5.5 | 2026-07-24 | A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for r… |
CVE-2026-16743 | Medium | 5.5 | 2026-07-24 | A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege dr… |
CVE-2026-16730 | Medium | 5.5 | 2026-07-24 | A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled a… |
CVE-2026-16910 | Medium | 5.5 | 2026-07-24 | A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF val… |
CVE-2026-12353 | Medium | 5.3 | 2026-07-23 | An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS endpoint… |