Red Hat
Page 3 of 74 — Red Hat CVEs from a corpus of 7330, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-87875 | Medium | 4.3 | 2026-09-09 | The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-o… |
CVE-2026-87874 | High | 8.1 | 2026-09-09 | A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON f… |
CVE-2026-87872 | Medium | 6.8 | 2026-09-09 | A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS cer… |
CVE-2026-87853 | High | 7.5 | 2026-09-09 | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the auth… |
CVE-2026-18147 | High | 8.1 | 2026-09-09 | A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password… |
CVE-2026-87766 | High | 8.8 | 2026-09-09 | A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot… |
CVE-2026-19729 | Medium | 4.9 | 2026-09-09 | A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs b… |
CVE-2026-86564 | Low | 3.3 | 2026-09-08 | A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds re… |
CVE-2026-18090 | Medium | 6.1 | 2026-09-08 | A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Imag… |
CVE-2026-78234 | Critical | 9.9 | 2026-09-08 | A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to min… |
CVE-2026-77968 | High | 8.2 | 2026-09-08 | A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator us… |
CVE-2026-74860 | High | 8.5 | 2026-09-08 | A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document cont… |
CVE-2026-74859 | Medium | 6.8 | 2026-09-08 | The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can… |
CVE-2026-76561 | High | 7.2 | 2026-09-08 | A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uplo… |
CVE-2026-86469 | Medium | 5.3 | 2026-09-07 | A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, th… |
CVE-2026-19843 | High | 8.4 | 2026-09-07 | A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) in… |
CVE-2026-18922 | Critical | 9.8 | 2026-09-07 | A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bin… |
CVE-2026-18453 | High | 7.5 | 2026-09-07 | A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attac… |
CVE-2026-18355 | High | 7.5 | 2026-09-07 | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read fr… |
CVE-2026-76560 | High | 7.5 | 2026-09-07 | A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stor… |
CVE-2026-79678 | High | 8.1 | 2026-09-07 | A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corr… |
CVE-2026-76578 | Critical | 9.8 | 2026-09-07 | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the t… |
CVE-2026-86404 | High | 8.8 | 2026-09-07 | EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implemen… |
CVE-2026-86332 | Medium | 6.5 | 2026-09-07 | A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the… |
CVE-2026-76925 | Medium | 5.8 | 2026-09-04 | A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulner… |
CVE-2026-85769 | Medium | 6.5 | 2026-09-04 | A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on… |
CVE-2026-85534 | Medium | 5.9 | 2026-09-04 | A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flo… |
CVE-2026-81666 | Medium | 6.5 | 2026-09-04 | An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-… |
CVE-2026-81665 | High | 7.5 | 2026-09-04 | A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffe… |
CVE-2026-85197 | High | 7.6 | 2026-09-04 | A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 cli… |
CVE-2026-84185 | Medium | 5.9 | 2026-09-03 | A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the l… |
CVE-2026-85150 | High | 7.5 | 2026-09-03 | A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate head… |
CVE-2026-71224 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk me… |
CVE-2026-71222 | Medium | 5.3 | 2026-09-03 | A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds vali… |
CVE-2026-71221 | High | 7.0 | 2026-09-03 | A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bo… |
CVE-2026-71220 | High | 7.0 | 2026-09-03 | A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index with… |
CVE-2026-71219 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the u… |
CVE-2026-66786 | Critical | 9.1 | 2026-09-02 | A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) with… |
CVE-2026-84838 | High | 7.8 | 2026-09-02 | A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress p… |
CVE-2026-84837 | High | 7.8 | 2026-09-02 | A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*`… |
CVE-2026-78410 | High | 7.8 | 2026-09-02 | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivil… |
CVE-2026-78409 | High | 7.0 | 2026-09-02 | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW… |
CVE-2026-78408 | High | 7.9 | 2026-09-02 | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes… |
CVE-2026-53683 | Medium | 4.3 | 2026-09-02 | reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionall… |
CVE-2026-82968 | Medium | 6.4 | 2026-09-02 | A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their loca… |
CVE-2026-84470 | Medium | 6.4 | 2026-09-01 | A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested… |
CVE-2026-84270 | Medium | 4.3 | 2026-09-01 | A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by th… |
CVE-2026-84269 | Medium | 6.5 | 2026-09-01 | A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the siz… |
CVE-2026-84268 | High | 8.8 | 2026-09-01 | A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that… |
CVE-2026-84267 | Medium | 4.3 | 2026-09-01 | A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length… |
CVE-2026-84232 | Medium | 5.4 | 2026-09-01 | A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., te… |
CVE-2026-49329 | High | 7.5 | 2026-09-01 | A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/langu… |
CVE-2026-84233 | High | 7.0 | 2026-09-01 | A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invok… |
CVE-2026-84218 | High | 8.1 | 2026-09-01 | A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist i… |
CVE-2026-53682 | Medium | 5.3 | 2026-09-01 | An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating int… |
CVE-2026-11873 | Medium | 6.5 | 2026-09-01 | An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malf… |
CVE-2026-18743 | Low | 2.5 | 2026-09-01 | A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a… |
CVE-2026-83596 | High | 8.8 | 2026-08-31 | A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. |
CVE-2026-13732 | High | 7.0 | 2026-08-31 | A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code tha… |
CVE-2026-17615 | High | 7.5 | 2026-08-31 | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending… |
CVE-2026-76763 | High | 7.5 | 2026-08-31 | A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthen… |
CVE-2026-12894 | High | 8.8 | 2026-08-31 | A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component… |
CVE-2026-81624 | High | 7.5 | 2026-08-31 | Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certa… |
CVE-2026-82343 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count pa… |
CVE-2026-82330 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memo… |
CVE-2026-82328 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palet… |
CVE-2026-82327 | Medium | 5.5 | 2026-08-28 | A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache file… |
CVE-2026-82324 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the… |
CVE-2026-18393 | Medium | 5.4 | 2026-08-28 | A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A rem… |
CVE-2026-80179 | Medium | 5.9 | 2026-08-28 | A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malfor… |
CVE-2026-81893 | Medium | 4.7 | 2026-08-27 | A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can lea… |
CVE-2026-78002 | High | 7.5 | 2026-08-27 | A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending speciall… |
CVE-2026-5680 | High | 7.5 | 2026-08-27 | A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negoti… |
CVE-2026-81668 | Medium | 5.4 | 2026-08-27 | A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated… |
CVE-2026-81658 | Medium | 6.5 | 2026-08-27 | A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authen… |
CVE-2026-80158 | Medium | 5.5 | 2026-08-26 | A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind p… |
CVE-2026-79902 | Medium | 5.5 | 2026-08-26 | A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA… |
CVE-2026-79654 | Medium | 4.3 | 2026-08-26 | A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An… |
CVE-2026-80186 | High | 7.6 | 2026-08-25 | A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a speciall… |
CVE-2026-80185 | Medium | 5.7 | 2026-08-25 | BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML pars… |
CVE-2026-80101 | Medium | 4.4 | 2026-08-25 | A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line pa… |
CVE-2026-77680 | Medium | 5.3 | 2026-08-25 | An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory am… |
CVE-2026-79992 | High | 7.8 | 2026-08-25 | A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP conca… |
CVE-2026-79717 | Medium | 6.4 | 2026-08-25 | A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace mana… |
CVE-2026-79655 | High | 7.8 | 2026-08-25 | A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By… |
CVE-2026-79652 | Medium | 5.9 | 2026-08-25 | A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handl… |
CVE-2026-78701 | Medium | 6.5 | 2026-08-25 | A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND p… |
CVE-2026-78322 | Medium | 6.5 | 2026-08-25 | A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's… |
CVE-2026-17113 | Medium | 6.0 | 2026-08-24 | A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdi… |
CVE-2026-78475 | Medium | 6.1 | 2026-08-24 | A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) o… |
CVE-2026-78465 | High | 7.0 | 2026-08-24 | A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes… |
CVE-2026-19685 | High | 7.1 | 2026-08-24 | NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix… |
CVE-2026-71366 | High | 7.7 | 2026-08-24 | A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notificat… |
CVE-2026-71364 | High | 7.2 | 2026-08-24 | A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining… |
CVE-2026-78376 | High | 8.8 | 2026-08-24 | A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruptio… |
CVE-2026-78367 | High | 7.0 | 2026-08-24 | A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes… |
CVE-2026-78323 | Medium | 6.5 | 2026-08-24 | A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certifica… |
CVE-2026-73267 | High | 7.7 | 2026-08-21 | A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim r… |
CVE-2026-73137 | High | 7.7 | 2026-08-20 | A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permission… |
CVE-2026-67567 | Critical | 9.9 | 2026-08-20 | A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resou… |