Red Hat
Page 3 of 19 — Red Hat CVEs from a corpus of 1811, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16768 | Medium | 5.3 | 2026-07-23 | A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can oc… |
CVE-2026-64611 | High | 7.5 | 2026-07-23 | A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device I… |
CVE-2026-16745 | High | 8.8 | 2026-07-23 | A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cl… |
CVE-2026-6390 | Medium | 6.8 | 2026-07-23 | A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specia… |
CVE-2026-16615 | Medium | 6.8 | 2026-07-22 | A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-ran… |
CVE-2026-16560 | Medium | 5.3 | 2026-07-22 | A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation a… |
CVE-2026-44191 | High | 7.8 | 2026-07-22 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ans… |
CVE-2026-44192 | Medium | 6.6 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate a… |
CVE-2026-44190 | High | 7.8 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unau… |
CVE-2026-44189 | High | 7.8 | 2026-07-22 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker t… |
CVE-2026-44187 | Low | 3.3 | 2026-07-22 | A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or mal… |
CVE-2026-16544 | Medium | 6.5 | 2026-07-22 | A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() functio… |
CVE-2026-16473 | Medium | 4.3 | 2026-07-22 | A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to trigger a one-byte heap o… |
CVE-2026-16517 | Low | 2.9 | 2026-07-21 | A signed integer overflow vulnerability was found in libarchive's ZIP writer. In the archive_write_zip_header function in archive_write_set_format_zip.c, when… |
CVE-2026-12548 | Medium | 4.2 | 2026-07-21 | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse()… |
CVE-2026-12547 | Low | 3.4 | 2026-07-21 | SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., vi… |
CVE-2026-16493 | High | 7.8 | 2026-07-21 | A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands with… |
CVE-2026-59851 | High | 8.8 | 2026-07-21 | A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is au… |
CVE-2026-59850 | Medium | 4.3 | 2026-07-21 | A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has alread… |
CVE-2026-59849 | Low | 3.1 | 2026-07-21 | A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured… |
CVE-2026-59848 | Medium | 5.3 | 2026-07-21 | A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded… |
CVE-2026-59847 | Medium | 5.9 | 2026-07-21 | A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an… |
CVE-2026-59846 | Low | 3.9 | 2026-07-21 | A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables a… |
CVE-2026-16445 | High | 7.5 | 2026-07-21 | A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a mal… |
CVE-2026-59845 | Medium | 5.3 | 2026-07-21 | A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent acr… |
CVE-2026-59844 | Medium | 6.5 | 2026-07-21 | A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to all… |
CVE-2026-59843 | Medium | 6.5 | 2026-07-21 | A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, causing later channel writes to loop… |
CVE-2026-59842 | Low | 3.7 | 2026-07-21 | A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without… |
CVE-2026-16461 | Medium | 6.5 | 2026-07-21 | A stack-based buffer overflow was found in rpcbind's rpcinfo utility. In rpcbdump() short mode (used by `rpcinfo -s`), version numbers from a remote RPCBPROC_D… |
CVE-2026-15370 | Medium | 6.7 | 2026-07-21 | A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. W… |
CVE-2026-15927 | Medium | 6.8 | 2026-07-21 | A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_refer… |
CVE-2026-15812 | Medium | 4.8 | 2026-07-21 | A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: <= 1.34). When the framework is explicitly config… |
CVE-2026-15811 | Medium | 5.8 | 2026-07-21 | A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive m… |
CVE-2026-64612 | High | 7.5 | 2026-07-20 | A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causi… |
CVE-2026-16277 | Medium | 6.5 | 2026-07-20 | A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with `rpcinfo -l`, address information returned by… |
CVE-2026-12701 | Critical | 9.0 | 2026-07-20 | A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to… |
CVE-2026-12080 | High | 7.3 | 2026-07-20 | A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by m… |
CVE-2026-16254 | Medium | 4.3 | 2026-07-20 | A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the sca… |
CVE-2026-15813 | Medium | 6.5 | 2026-07-20 | A vulnerability was found in the network packet de-fragmentation engine of kronosnet (Version affected <= 1.34). The internal reassembly code does not properly… |
CVE-2026-15588 | Medium | 5.3 | 2026-07-20 | A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforc… |
CVE-2026-16242 | Critical | 9.4 | 2026-07-20 | A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and… |
CVE-2026-16118 | High | 7.1 | 2026-07-17 | A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian sy… |
CVE-2026-16108 | Medium | 4.3 | 2026-07-17 | A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatic… |
CVE-2026-16106 | Medium | 4.9 | 2026-07-17 | A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to… |
CVE-2026-16104 | Medium | 4.3 | 2026-07-17 | A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identi… |
CVE-2026-16103 | Medium | 4.3 | 2026-07-17 | A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were ad… |
CVE-2026-16093 | Medium | 5.4 | 2026-07-17 | Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication… |
CVE-2026-16089 | Medium | 5.4 | 2026-07-17 | A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound… |
CVE-2026-16072 | Medium | 4.9 | 2026-07-17 | A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitati… |
CVE-2026-15943 | Medium | 5.5 | 2026-07-17 | A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrat… |
CVE-2026-15945 | Medium | 4.3 | 2026-07-16 | A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a del… |
CVE-2026-5674 | High | 8.8 | 2026-07-16 | A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeW… |
CVE-2026-48863 | High | 7.5 | 2026-07-16 | A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying… |
CVE-2026-3842 | High | 7.8 | 2026-07-16 | A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when… |
CVE-2026-23538 | High | 7.5 | 2026-07-16 | A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections wit… |
CVE-2026-1609 | High | 8.1 | 2026-07-16 | A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to va… |
CVE-2026-12382 | High | 8.2 | 2026-07-15 | A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requ… |
CVE-2026-15809 | High | 7.8 | 2026-07-15 | A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting envir… |
CVE-2026-15779 | Medium | 6.1 | 2026-07-15 | A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account's home directory without validating the path is not a… |
CVE-2026-14251 | High | 7.7 | 2026-07-15 | A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A name… |
CVE-2026-15714 | Medium | 6.5 | 2026-07-14 | An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() fu… |
CVE-2026-15713 | Medium | 5.9 | 2026-07-14 | A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termi… |
CVE-2026-15711 | High | 7.5 | 2026-07-14 | A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which man… |
CVE-2026-15709 | High | 7.5 | 2026-07-14 | A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes da… |
CVE-2026-15712 | Medium | 5.9 | 2026-07-14 | A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library proce… |
CVE-2026-12478 | Medium | 4.8 | 2026-07-14 | The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client fra… |
CVE-2026-15416 | High | 8.9 | 2026-07-14 | A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the A… |
CVE-2026-15584 | High | 7.5 | 2026-07-13 | A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access i… |
CVE-2026-62147 | Medium | 6.5 | 2026-07-13 | The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, al… |
CVE-2026-15574 | High | 7.5 | 2026-07-13 | A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, whi… |
CVE-2026-15143 | Critical | 9.3 | 2026-07-10 | A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Defin… |
CVE-2026-15378 | Critical | 9.3 | 2026-07-10 | A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by… |
CVE-2026-15028 | Low | 3.9 | 2026-07-10 | A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue… |
CVE-2026-59692 | High | 7.5 | 2026-07-09 | A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed… |
CVE-2026-59691 | High | 7.1 | 2026-07-09 | A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp frame… |
CVE-2026-15154 | Medium | 6.5 | 2026-07-08 | A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, known as Regular Expression Denial of Service (ReDoS), all… |
CVE-2026-15063 | Medium | 6.3 | 2026-07-08 | A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes… |
CVE-2026-15044 | Medium | 6.3 | 2026-07-08 | A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardrails, if a specific security setting is not enabled, these s… |
CVE-2026-15041 | Low | 3.7 | 2026-07-08 | A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a co… |
CVE-2025-12799 | Medium | 6.5 | 2026-07-07 | A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters i… |
CVE-2026-14969 | Medium | 4.4 | 2026-07-07 | A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations… |
CVE-2026-14935 | Low | 3.7 | 2026-07-07 | A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to a… |
CVE-2026-14940 | Medium | 5.3 | 2026-07-07 | A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value enc… |
CVE-2026-14476 | High | 8.0 | 2026-07-07 | A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LD… |
CVE-2026-14474 | High | 8.8 | 2026-07-07 | A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree… |
CVE-2026-11610 | High | 8.8 | 2026-07-07 | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF… |
CVE-2026-58384 | High | 7.3 | 2026-07-07 | A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after wh… |
CVE-2026-59089 | Medium | 5.5 | 2026-07-06 | A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Ta… |
CVE-2026-58380 | High | 7.3 | 2026-07-06 | A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one b… |
CVE-2026-9165 | High | 7.7 | 2026-07-06 | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated G… |
CVE-2026-14781 | Medium | 4.8 | 2026-07-05 | A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider i… |
CVE-2026-58379 | High | 7.3 | 2026-07-03 | A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code ex… |
CVE-2026-14615 | Medium | 4.3 | 2026-07-03 | A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system… |
CVE-2026-14614 | Medium | 5.4 | 2026-07-03 | A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a del… |
CVE-2026-14613 | Medium | 4.3 | 2026-07-03 | A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have ac… |
CVE-2026-14612 | Medium | 4.2 | 2026-07-03 | Two off-by-one errors in the FreeIPA ipa-otpd daemon's OAuth2 device authorization handler can cause out-of-bounds memory access when processing an oversized r… |
CVE-2026-14544 | Critical | 9.8 | 2026-07-03 | A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to esc… |
CVE-2026-58381 | Medium | 6.1 | 2026-07-02 | A flaw was found in GIMP's PSP file format parser. A double-free condition occurs in the read_layer_block() function when processing a specially crafted PSP fi… |
CVE-2026-5142 | Medium | 6.5 | 2026-07-01 | A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure She… |
CVE-2026-5138 | Medium | 4.3 | 2026-07-01 | A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occu… |