Red Hat
Page 2 of 74 — Red Hat CVEs from a corpus of 7332, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94368 | High | 7.1 | 2026-09-21 | A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the serv… |
CVE-2026-92574 | High | 8.8 | 2026-09-21 | A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes sec… |
CVE-2026-15801 | High | 8.0 | 2026-09-21 | A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint arch… |
CVE-2026-94218 | Low | 3.1 | 2026-09-21 | A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enfor… |
CVE-2026-94217 | Low | 3.5 | 2026-09-21 | A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission t… |
CVE-2026-94215 | Medium | 5.5 | 2026-09-21 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request… |
CVE-2026-94213 | Medium | 4.9 | 2026-09-21 | A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy ev… |
CVE-2026-94001 | Medium | 6.5 | 2026-09-19 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials doe… |
CVE-2026-94000 | Medium | 6.6 | 2026-09-19 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints… |
CVE-2026-93999 | Medium | 4.2 | 2026-09-19 | A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token ref… |
CVE-2026-75885 | Critical | 9.3 | 2026-09-18 | A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send… |
CVE-2026-93574 | Medium | 6.5 | 2026-09-18 | A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size… |
CVE-2026-93562 | Medium | 6.5 | 2026-09-18 | A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smugg… |
CVE-2026-91205 | Medium | 6.0 | 2026-09-18 | A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a… |
CVE-2026-91203 | Medium | 6.0 | 2026-09-18 | A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged f… |
CVE-2026-91202 | Medium | 6.1 | 2026-09-18 | A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and… |
CVE-2026-93432 | Medium | 6.1 | 2026-09-18 | A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content… |
CVE-2026-92768 | Medium | 5.5 | 2026-09-18 | A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext pass… |
CVE-2026-92747 | Medium | 5.0 | 2026-09-18 | A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virt… |
CVE-2026-92745 | Medium | 5.0 | 2026-09-18 | A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat S… |
CVE-2026-93579 | Medium | 6.5 | 2026-09-18 | A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Ret… |
CVE-2026-91149 | High | 7.5 | 2026-09-18 | A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections t… |
CVE-2026-91147 | Medium | 5.9 | 2026-09-18 | A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafte… |
CVE-2026-91142 | Low | 3.6 | 2026-09-18 | A flaw was found in Cockpit. An integer overflow vulnerability in the `do_lastlog()` function, specifically in the offset calculation for `lastlog` entries on… |
CVE-2026-93685 | Medium | 5.4 | 2026-09-18 | A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in th… |
CVE-2026-93676 | Low | 3.2 | 2026-09-18 | xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak app… |
CVE-2026-93653 | Medium | 5.5 | 2026-09-18 | A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutpu… |
CVE-2026-93576 | High | 7.5 | 2026-09-18 | A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-nam… |
CVE-2026-93573 | Medium | 6.5 | 2026-09-18 | A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Tra… |
CVE-2026-93569 | High | 8.2 | 2026-09-18 | A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request… |
CVE-2026-93568 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's… |
CVE-2026-93567 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONN… |
CVE-2026-93566 | Medium | 6.5 | 2026-09-18 | A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-s… |
CVE-2026-93565 | High | 7.5 | 2026-09-18 | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming… |
CVE-2026-93564 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted P… |
CVE-2026-93558 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to… |
CVE-2026-85511 | Medium | 4.2 | 2026-09-18 | A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter… |
CVE-2026-10832 | Medium | 5.9 | 2026-09-18 | A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a special… |
CVE-2026-93560 | High | 7.5 | 2026-09-18 | A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum inte… |
CVE-2026-93492 | Medium | 5.3 | 2026-09-18 | A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE… |
CVE-2026-93491 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single conn… |
CVE-2026-93488 | High | 7.5 | 2026-09-18 | A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Int… |
CVE-2026-93578 | Medium | 5.9 | 2026-09-18 | A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OC… |
CVE-2026-93575 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet… |
CVE-2026-93572 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP)… |
CVE-2026-93563 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit th… |
CVE-2026-93561 | Medium | 6.5 | 2026-09-18 | A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types ins… |
CVE-2026-81627 | High | 8.2 | 2026-09-18 | A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A pr… |
CVE-2026-87743 | High | 7.5 | 2026-09-18 | A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and H… |
CVE-2026-93494 | High | 7.5 | 2026-09-18 | A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body wi… |
CVE-2026-93493 | Medium | 5.9 | 2026-09-18 | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Prot… |
CVE-2026-89059 | High | 7.5 | 2026-09-18 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensi… |
CVE-2026-89058 | High | 7.4 | 2026-09-18 | A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-A… |
CVE-2026-76781 | Medium | 5.5 | 2026-09-17 | A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog pa… |
CVE-2026-87742 | High | 7.5 | 2026-09-17 | A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single… |
CVE-2026-81829 | Medium | 5.3 | 2026-09-17 | A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When th… |
CVE-2026-92904 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocat… |
CVE-2026-92925 | High | 7.1 | 2026-09-17 | A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-ca… |
CVE-2026-92893 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not en… |
CVE-2026-92894 | Medium | 4.3 | 2026-09-17 | A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying… |
CVE-2026-86320 | High | 7.8 | 2026-09-17 | A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious… |
CVE-2026-85469 | High | 8.0 | 2026-09-16 | A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` used in the release… |
CVE-2026-42784 | High | 7.4 | 2026-09-16 | A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discre… |
CVE-2026-92615 | Medium | 6.6 | 2026-09-16 | A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include Insecu… |
CVE-2026-79651 | High | 7.5 | 2026-09-16 | A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and the… |
CVE-2026-74909 | High | 8.1 | 2026-09-16 | Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enf… |
CVE-2026-18212 | High | 7.5 | 2026-09-16 | A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the… |
CVE-2026-92091 | Medium | 5.9 | 2026-09-16 | A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexit… |
CVE-2026-92358 | Medium | 6.4 | 2026-09-16 | A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is cre… |
CVE-2025-11395 | Medium | 5.5 | 2026-09-15 | A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the priv… |
CVE-2026-92248 | High | 7.8 | 2026-09-15 | A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer ov… |
CVE-2026-85234 | High | 7.5 | 2026-09-15 | A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can p… |
CVE-2026-79705 | Medium | 4.5 | 2026-09-15 | A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can e… |
CVE-2026-79699 | Medium | 4.4 | 2026-09-15 | A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction de… |
CVE-2026-85013 | High | 7.3 | 2026-09-15 | A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the… |
CVE-2026-91926 | Low | 3.7 | 2026-09-15 | A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV… |
CVE-2026-91786 | Medium | 6.1 | 2026-09-15 | A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions aga… |
CVE-2026-75092 | High | 7.3 | 2026-09-15 | A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the… |
CVE-2026-81320 | Medium | 5.5 | 2026-09-15 | A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object… |
CVE-2026-81303 | Medium | 6.3 | 2026-09-15 | A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName val… |
CVE-2026-90996 | Medium | 4.0 | 2026-09-14 | A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) respo… |
CVE-2026-90995 | Medium | 5.5 | 2026-09-14 | A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder… |
CVE-2026-90994 | Medium | 4.0 | 2026-09-14 | A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client wi… |
CVE-2026-90947 | High | 7.8 | 2026-09-14 | A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light… |
CVE-2026-90463 | Medium | 4.0 | 2026-09-14 | A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests t… |
CVE-2026-90949 | High | 7.8 | 2026-09-14 | A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mi… |
CVE-2026-90948 | High | 7.8 | 2026-09-14 | A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation… |
CVE-2026-89329 | Medium | 6.2 | 2026-09-11 | A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands… |
CVE-2026-18495 | Medium | 6.1 | 2026-09-11 | A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted B… |
CVE-2026-89298 | Medium | 4.9 | 2026-09-11 | A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user w… |
CVE-2026-77159 | Medium | 5.5 | 2026-09-11 | A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without chec… |
CVE-2026-89060 | High | 7.7 | 2026-09-11 | A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn config… |
CVE-2026-88914 | Medium | 4.4 | 2026-09-11 | A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an… |
CVE-2026-88924 | High | 7.0 | 2026-09-10 | A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the li… |
CVE-2026-88859 | Medium | 6.3 | 2026-09-10 | A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. W… |
CVE-2026-84828 | Medium | 6.5 | 2026-09-10 | A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' comm… |
CVE-2026-88265 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file… |
CVE-2026-88264 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-cont… |
CVE-2026-84042 | High | 7.8 | 2026-09-10 | A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-… |
CVE-2026-88770 | Medium | 6.5 | 2026-09-10 | A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption… |