Red Hat
Page 6 of 19 — Red Hat CVEs from a corpus of 1811, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2708 | Low | 3.7 | 2026-04-23 | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-he… |
CVE-2026-34003 | High | 7.8 | 2026-04-23 | A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to… |
CVE-2026-34001 | High | 7.8 | 2026-04-23 | A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFenc… |
CVE-2026-33999 | High | 7.8 | 2026-04-23 | A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local… |
CVE-2025-66286 | Medium | 4.7 | 2026-04-23 | An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Application… |
CVE-2025-13763 | Medium | 5.7 | 2026-04-23 | Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB… |
CVE-2026-6862 | Medium | 5.5 | 2026-04-22 | A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4… |
CVE-2026-6861 | Medium | 6.1 | 2026-04-22 | A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially crafted SVG (Scalable Vector Graphics) CSS… |
CVE-2026-6859 | High | 8.8 | 2026-04-22 | A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote atta… |
CVE-2026-6857 | High | 7.5 | 2026-04-22 | A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker wi… |
CVE-2026-6855 | High | 7.1 | 2026-04-22 | A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in the chat session handler by manipulating the `logs_dir` param… |
CVE-2026-6848 | Medium | 5.4 | 2026-04-22 | A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or robot account creat… |
CVE-2026-6846 | High | 7.8 | 2026-04-22 | A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object… |
CVE-2026-6845 | Medium | 5.0 | 2026-04-22 | A flaw was found in binutils, specifically within the `readelf` utility. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by trick… |
CVE-2026-6844 | Medium | 5.5 | 2026-04-22 | A flaw was found in the `readelf` utility of the binutils package. A local attacker could exploit two Denial of Service (DoS) vulnerabilities by providing a sp… |
CVE-2026-6843 | Medium | 5.5 | 2026-04-22 | A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containi… |
CVE-2026-6842 | Low | 2.5 | 2026-04-22 | A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) f… |
CVE-2026-6507 | High | 7.5 | 2026-04-17 | A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol… |
CVE-2026-6494 | Medium | 5.3 | 2026-04-17 | A flaw was found in the AAP MCP server. An unauthenticated remote attacker can exploit a log injection vulnerability by sending specially crafted input to the… |
CVE-2026-6388 | Critical | 9.1 | 2026-04-15 | A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to create or modify an ImageUpdater resource in a multi-tenan… |
CVE-2026-6385 | Medium | 6.5 | 2026-04-15 | A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious D… |
CVE-2026-6384 | High | 7.3 | 2026-04-15 | A flaw was found in gimp. This buffer overflow vulnerability in the GIF image loading component's `ReadJeffsImage` function allows an attacker to write beyond… |
CVE-2026-40919 | Medium | 6.1 | 2026-04-15 | A flaw was found in GIMP. This vulnerability, a buffer overflow in the `file-seattle-filmworks` plugin, can be exploited when a user opens a specially crafted… |
CVE-2026-40918 | Medium | 5.5 | 2026-04-15 | A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This occurs due to a stack… |
CVE-2026-40917 | Medium | 5.0 | 2026-04-15 | A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files… |
CVE-2026-40916 | Medium | 5.0 | 2026-04-15 | A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (… |
CVE-2026-40915 | Medium | 5.5 | 2026-04-15 | A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file… |
CVE-2026-6383 | Medium | 5.4 | 2026-04-15 | A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading t… |
CVE-2026-6245 | Medium | 5.5 | 2026-04-15 | A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM passkey responder fails to properly h… |
CVE-2026-37980 | Medium | 6.9 | 2026-04-14 | A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administra… |
CVE-2026-5483 | High | 8.5 | 2026-04-10 | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the d… |
CVE-2026-1584 | High | 7.5 | 2026-04-09 | A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invali… |
CVE-2026-4878 | Medium | 6.7 | 2026-04-09 | A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This… |
CVE-2026-32591 | Medium | 5.2 | 2026-04-08 | A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Qua… |
CVE-2026-32590 | High | 7.1 | 2026-04-08 | A flaw was found in Red Hat Quay's handling of resumable container image layer uploads. The upload process stores intermediate data in the database using a for… |
CVE-2026-32589 | High | 7.4 | 2026-04-08 | A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with… |
CVE-2026-2377 | Medium | 6.5 | 2026-04-08 | A flaw was found in Red Hat Quay and mirror registry for Red Hat OpenShift. The log export feature in these products allows an authenticated user to specify an… |
CVE-2025-14243 | Medium | 5.3 | 2026-04-08 | A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email address… |
CVE-2025-58713 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Red Hat Process Automation Manager images. This issue stems from the /etc/passwd file being created… |
CVE-2025-57854 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain OpenShift Update Service (OSUS) images. This issue stems from the /etc/passwd file being created wit… |
CVE-2025-57853 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Web Terminal images. This issue stems from the /etc/passwd file being created with group-writable pe… |
CVE-2025-57851 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images. This issue stems from the /etc/passwd file being created… |
CVE-2025-57847 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with g… |
CVE-2026-4631 | Critical | 9.8 | 2026-04-07 | Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An att… |
CVE-2025-14821 | High | 7.8 | 2026-04-07 | A flaw was found in libssh. This vulnerability allows local man-in-the-middle attacks, security downgrades of SSH (Secure Shell) connections, and manipulation… |
CVE-2026-5745 | Medium | 5.5 | 2026-04-07 | A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() fu… |
CVE-2026-4740 | High | 8.2 | 2026-04-07 | A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes clien… |
CVE-2026-5704 | Medium | 5.0 | 2026-04-06 | A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attack… |
CVE-2026-5673 | Medium | 5.6 | 2026-04-06 | A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_… |
CVE-2026-37977 | Low | 3.7 | 2026-04-06 | A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Ac… |
CVE-2026-3184 | Low | 3.7 | 2026-04-03 | A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote… |
CVE-2026-2625 | Medium | 4.0 | 2026-04-03 | A flaw was found in rust-rpm-sequoia. An attacker can exploit this vulnerability by providing a specially crafted Red Hat Package Manager (RPM) file. During th… |
CVE-2026-4636 | High | 8.1 | 2026-04-02 | A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attack… |
CVE-2026-4634 | High | 7.5 | 2026-04-02 | A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long s… |
CVE-2026-4325 | Medium | 5.3 | 2026-04-02 | A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an at… |
CVE-2026-4282 | High | 7.4 | 2026-04-02 | A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an un… |
CVE-2026-3872 | High | 7.3 | 2026-04-02 | A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform R… |
CVE-2026-35094 | Low | 3.3 | 2026-04-01 | A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a dangling pointer vulnerability. T… |
CVE-2026-35093 | High | 8.8 | 2026-04-01 | A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypa… |
CVE-2026-35092 | High | 7.5 | 2026-04-01 | A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send… |
CVE-2026-35091 | High | 8.2 | 2026-04-01 | A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity c… |
CVE-2026-5201 | High | 7.5 | 2026-03-31 | A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color c… |
CVE-2026-5165 | Medium | 6.7 | 2026-03-30 | A flaw was found in virtio-win, specifically within the VirtIO Block (BLK) device. When the device undergoes a reset, it fails to properly manage memory, resul… |
CVE-2026-5164 | Medium | 6.7 | 2026-03-30 | A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A… |
CVE-2026-5121 | High | 7.5 | 2026-03-30 | A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can… |
CVE-2026-5119 | Medium | 5.9 | 2026-03-30 | A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies are transmitted in cleartext within the… |
CVE-2026-28369 | High | 8.7 | 2026-03-27 | A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the r… |
CVE-2026-28368 | High | 8.7 | 2026-03-27 | A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by… |
CVE-2026-28367 | High | 8.7 | 2026-03-27 | A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request s… |
CVE-2026-4948 | Medium | 5.5 | 2026-03-27 | A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSett… |
CVE-2025-12805 | High | 8.1 | 2026-03-26 | A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other… |
CVE-2026-2272 | Medium | 4.3 | 2026-03-26 | A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and `ico_read_icon` fun… |
CVE-2026-2271 | Low | 3.3 | 2026-03-26 | A flaw was found in GIMP's PSP (Paint Shop Pro) file parser. A remote attacker could exploit an integer overflow vulnerability in the read_creator_block() func… |
CVE-2026-2239 | Low | 2.8 | 2026-03-26 | A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the fread_pascal_string function when processing a specially crafted PSD (Photoshop Docu… |
CVE-2026-2100 | Medium | 5.3 | 2026-03-26 | A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber o… |
CVE-2026-0968 | Low | 3.1 | 2026-03-26 | A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SS… |
CVE-2026-0967 | Medium | 5.5 | 2026-03-26 | A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when process… |
CVE-2026-0966 | High | 8.2 | 2026-03-26 | A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited rem… |
CVE-2026-0965 | Low | 3.3 | 2026-03-26 | A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a maliciou… |
CVE-2026-0964 | Medium | 6.3 | 2026-03-26 | A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misuse… |
CVE-2026-2436 | Medium | 6.5 | 2026-03-26 | A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees co… |
CVE-2026-3190 | Medium | 4.3 | 2026-03-26 | A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check… |
CVE-2026-3121 | Medium | 6.5 | 2026-03-26 | A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-p… |
CVE-2026-4897 | Medium | 5.5 | 2026-03-26 | A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary… |
CVE-2026-4887 | Medium | 6.1 | 2026-03-26 | A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by con… |
CVE-2026-1961 | High | 8.0 | 2026-03-26 | A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability… |
CVE-2026-4874 | Low | 3.1 | 2026-03-26 | A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter duri… |
CVE-2026-4775 | High | 7.8 | 2026-03-24 | A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by pr… |
CVE-2026-1940 | Medium | 5.1 | 2026-03-23 | An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk() function. The patch added a size validation check lsize + 8 > si… |
CVE-2026-4647 | Medium | 6.1 | 2026-03-23 | A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when… |
CVE-2026-4633 | Low | 3.7 | 2026-03-23 | A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. Th… |
CVE-2026-4628 | Medium | 4.3 | 2026-03-23 | A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with vali… |
CVE-2026-23536 | High | 7.5 | 2026-03-20 | A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated remote attacker to read any file accessi… |
CVE-2026-4426 | Medium | 6.5 | 2026-03-19 | A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log… |
CVE-2026-4424 | High | 7.5 | 2026-03-19 | A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sl… |
CVE-2026-2369 | Medium | 6.5 | 2026-03-19 | A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This… |
CVE-2026-4366 | Medium | 5.8 | 2026-03-18 | A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client config… |
CVE-2026-2575 | Medium | 5.3 | 2026-03-18 | A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRe… |
CVE-2026-2603 | High | 8.1 | 2026-03-18 | A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the… |
CVE-2026-2092 | High | 7.7 | 2026-03-18 | A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the ove… |