Red Hat
Page 3 of 74 — Red Hat CVEs from a corpus of 7350, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90947 | High | 7.8 | 2026-09-14 | A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light… |
CVE-2026-90463 | Medium | 4.0 | 2026-09-14 | A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests t… |
CVE-2026-90949 | High | 7.8 | 2026-09-14 | A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mi… |
CVE-2026-90948 | High | 7.8 | 2026-09-14 | A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation… |
CVE-2026-89329 | Medium | 6.2 | 2026-09-11 | A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands… |
CVE-2026-18495 | Medium | 6.1 | 2026-09-11 | A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted B… |
CVE-2026-89298 | Medium | 4.9 | 2026-09-11 | A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user w… |
CVE-2026-77159 | Medium | 5.5 | 2026-09-11 | A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without chec… |
CVE-2026-89060 | High | 7.7 | 2026-09-11 | A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn config… |
CVE-2026-88914 | Medium | 4.4 | 2026-09-11 | A flaw was found in GStreamer's gst-plugins-good isomp4 plugin. When processing a specially crafted MP4 or MOV file containing CEA-608 closed-caption data, an… |
CVE-2026-88924 | High | 7.0 | 2026-09-10 | A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the li… |
CVE-2026-88859 | Medium | 6.3 | 2026-09-10 | A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. W… |
CVE-2026-84828 | Medium | 6.5 | 2026-09-10 | A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' comm… |
CVE-2026-88265 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file… |
CVE-2026-88264 | Medium | 5.6 | 2026-09-10 | A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-cont… |
CVE-2026-84042 | High | 7.8 | 2026-09-10 | A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-… |
CVE-2026-88770 | Medium | 6.5 | 2026-09-10 | A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption… |
CVE-2026-88763 | Medium | 5.9 | 2026-09-10 | A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. T… |
CVE-2026-87876 | Low | 3.0 | 2026-09-09 | Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attri… |
CVE-2026-87875 | Medium | 4.3 | 2026-09-09 | The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-o… |
CVE-2026-87874 | High | 8.1 | 2026-09-09 | A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON f… |
CVE-2026-87872 | Medium | 6.8 | 2026-09-09 | A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS cer… |
CVE-2026-87853 | High | 7.5 | 2026-09-09 | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the auth… |
CVE-2026-18147 | High | 8.1 | 2026-09-09 | A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password… |
CVE-2026-87766 | High | 8.8 | 2026-09-09 | A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot… |
CVE-2026-19729 | Medium | 4.9 | 2026-09-09 | A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs b… |
CVE-2026-86564 | Low | 3.3 | 2026-09-08 | A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds re… |
CVE-2026-18090 | Medium | 6.1 | 2026-09-08 | A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Imag… |
CVE-2026-78234 | Critical | 9.9 | 2026-09-08 | A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to min… |
CVE-2026-77968 | High | 8.2 | 2026-09-08 | A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator us… |
CVE-2026-74860 | High | 8.5 | 2026-09-08 | A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document cont… |
CVE-2026-74859 | Medium | 6.8 | 2026-09-08 | The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can… |
CVE-2026-76561 | High | 7.2 | 2026-09-08 | A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uplo… |
CVE-2026-86469 | Medium | 5.3 | 2026-09-07 | A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, th… |
CVE-2026-19843 | High | 8.4 | 2026-09-07 | A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) in… |
CVE-2026-18922 | Critical | 9.8 | 2026-09-07 | A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bin… |
CVE-2026-18453 | High | 7.5 | 2026-09-07 | A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attac… |
CVE-2026-18355 | High | 7.5 | 2026-09-07 | A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read fr… |
CVE-2026-76560 | High | 7.5 | 2026-09-07 | A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stor… |
CVE-2026-79678 | High | 8.1 | 2026-09-07 | A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corr… |
CVE-2026-76578 | Critical | 9.8 | 2026-09-07 | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the t… |
CVE-2026-86404 | High | 8.8 | 2026-09-07 | EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implemen… |
CVE-2026-86332 | Medium | 6.5 | 2026-09-07 | A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the… |
CVE-2026-76925 | Medium | 5.8 | 2026-09-04 | A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulner… |
CVE-2026-85769 | Medium | 6.5 | 2026-09-04 | A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on… |
CVE-2026-85534 | Medium | 5.9 | 2026-09-04 | A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flo… |
CVE-2026-81666 | Medium | 6.5 | 2026-09-04 | An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-… |
CVE-2026-81665 | High | 7.5 | 2026-09-04 | A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffe… |
CVE-2026-85197 | High | 7.6 | 2026-09-04 | A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 cli… |
CVE-2026-84185 | Medium | 5.9 | 2026-09-03 | A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the l… |
CVE-2026-85150 | High | 7.5 | 2026-09-03 | A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate head… |
CVE-2026-71224 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk me… |
CVE-2026-71222 | Medium | 5.3 | 2026-09-03 | A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds vali… |
CVE-2026-71221 | High | 7.0 | 2026-09-03 | A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bo… |
CVE-2026-71220 | High | 7.0 | 2026-09-03 | A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index with… |
CVE-2026-71219 | Medium | 4.7 | 2026-09-03 | A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the u… |
CVE-2026-66786 | Critical | 9.1 | 2026-09-02 | A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) with… |
CVE-2026-84838 | High | 7.8 | 2026-09-02 | A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress p… |
CVE-2026-84837 | High | 7.8 | 2026-09-02 | A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*`… |
CVE-2026-78410 | High | 7.8 | 2026-09-02 | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivil… |
CVE-2026-78409 | High | 7.0 | 2026-09-02 | The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW… |
CVE-2026-78408 | High | 7.9 | 2026-09-02 | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes… |
CVE-2026-53683 | Medium | 4.3 | 2026-09-02 | reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionall… |
CVE-2026-82968 | Medium | 6.4 | 2026-09-02 | A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their loca… |
CVE-2026-84470 | Medium | 6.4 | 2026-09-01 | A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested… |
CVE-2026-84270 | Medium | 4.3 | 2026-09-01 | A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by th… |
CVE-2026-84269 | Medium | 6.5 | 2026-09-01 | A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the siz… |
CVE-2026-84268 | High | 8.8 | 2026-09-01 | A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that… |
CVE-2026-84267 | Medium | 4.3 | 2026-09-01 | A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length… |
CVE-2026-84232 | Medium | 5.4 | 2026-09-01 | A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., te… |
CVE-2026-49329 | High | 7.5 | 2026-09-01 | A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/langu… |
CVE-2026-84233 | High | 7.0 | 2026-09-01 | A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invok… |
CVE-2026-84218 | High | 8.1 | 2026-09-01 | A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist i… |
CVE-2026-53682 | Medium | 5.3 | 2026-09-01 | An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating int… |
CVE-2026-11873 | Medium | 6.5 | 2026-09-01 | An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malf… |
CVE-2026-18743 | Low | 2.5 | 2026-09-01 | A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a… |
CVE-2026-83596 | High | 8.8 | 2026-08-31 | A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. |
CVE-2026-13732 | High | 7.0 | 2026-08-31 | A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code tha… |
CVE-2026-17615 | High | 7.5 | 2026-08-31 | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending… |
CVE-2026-76763 | High | 7.5 | 2026-08-31 | A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthen… |
CVE-2026-12894 | High | 8.8 | 2026-08-31 | A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component… |
CVE-2026-81624 | High | 7.5 | 2026-08-31 | Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certa… |
CVE-2026-82343 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count pa… |
CVE-2026-82330 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memo… |
CVE-2026-82328 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palet… |
CVE-2026-82327 | Medium | 5.5 | 2026-08-28 | A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache file… |
CVE-2026-82324 | Medium | 6.1 | 2026-08-28 | A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the… |
CVE-2026-18393 | Medium | 5.4 | 2026-08-28 | A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A rem… |
CVE-2026-80179 | Medium | 5.9 | 2026-08-28 | A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malfor… |
CVE-2026-81893 | Medium | 4.7 | 2026-08-27 | A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can lea… |
CVE-2026-78002 | High | 7.5 | 2026-08-27 | A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending speciall… |
CVE-2026-5680 | High | 7.5 | 2026-08-27 | A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negoti… |
CVE-2026-81668 | Medium | 5.4 | 2026-08-27 | A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated… |
CVE-2026-81658 | Medium | 6.5 | 2026-08-27 | A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authen… |
CVE-2026-80158 | Medium | 5.5 | 2026-08-26 | A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind p… |
CVE-2026-79902 | Medium | 5.5 | 2026-08-26 | A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA… |
CVE-2026-79654 | Medium | 4.3 | 2026-08-26 | A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An… |
CVE-2026-80186 | High | 7.6 | 2026-08-25 | A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a speciall… |
CVE-2026-80185 | Medium | 5.7 | 2026-08-25 | BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML pars… |
CVE-2026-80101 | Medium | 4.4 | 2026-08-25 | A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line pa… |