Red Hat
Page 8 of 74 — Red Hat CVEs from a corpus of 7332, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12969 | Medium | 5.3 | 2026-06-23 | An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with ex… |
CVE-2026-10609 | Medium | 6.8 | 2026-06-23 | A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destination… |
CVE-2023-54365 | High | 7.5 | 2026-06-23 | Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP… |
CVE-2026-55655 | Medium | 5.0 | 2026-06-23 | A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-bi… |
CVE-2026-55654 | Low | 3.7 | 2026-06-23 | A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanup of GSSAPI (Generic Security Service Application Programmi… |
CVE-2026-55653 | Medium | 4.3 | 2026-06-23 | A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occ… |
CVE-2026-12725 | Medium | 5.9 | 2026-06-22 | A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupp… |
CVE-2026-12549 | Medium | 4.8 | 2026-06-22 | The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client se… |
CVE-2026-54100 | High | 8.3 | 2026-06-22 | A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to Windows worker nod… |
CVE-2026-54099 | High | 8.8 | 2026-06-22 | A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificat… |
CVE-2026-12726 | Medium | 6.3 | 2026-06-19 | A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value… |
CVE-2026-56211 | High | 7.1 | 2026-06-19 | A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Sca… |
CVE-2026-56210 | High | 7.1 | 2026-06-19 | A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding… |
CVE-2026-56209 | High | 7.1 | 2026-06-19 | An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding)… |
CVE-2026-56208 | High | 7.6 | 2026-06-19 | A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode… |
CVE-2026-3196 | Medium | 5.5 | 2026-06-19 | An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream c… |
CVE-2026-3195 | High | 7.4 | 2026-06-19 | A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov c… |
CVE-2026-12706 | Medium | 6.5 | 2026-06-19 | A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but… |
CVE-2026-11791 | Medium | 5.0 | 2026-06-18 | A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, by… |
CVE-2026-12505 | High | 7.8 | 2026-06-18 | A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a… |
CVE-2026-47774 | High | 7.5 | 2026-06-17 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability i… |
CVE-2026-12515 | Medium | 4.3 | 2026-06-17 | A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allo… |
CVE-2026-42055 | High | 8.1 | 2026-06-17 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the prox… |
CVE-2026-12528 | Medium | 5.4 | 2026-06-17 | A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trig… |
CVE-2026-2604 | Medium | 5.6 | 2026-06-17 | A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craf… |
CVE-2026-12491 | Medium | 4.8 | 2026-06-17 | A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specif… |
CVE-2026-4367 | Medium | 5.5 | 2026-06-16 | A flaw was found in libXpm. A local user with low privileges could exploit an Out-of-Bounds Read vulnerability in the `xpmNextWord()` function by processing a… |
CVE-2026-10649 | High | 8.6 | 2026-06-16 | A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By… |
CVE-2026-12398 | High | 7.5 | 2026-06-16 | A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref na… |
CVE-2026-42014 | Medium | 6.6 | 2026-06-16 | A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability… |
CVE-2026-1767 | Medium | 5.6 | 2026-06-16 | A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3 Extractor `tracker-extract-mp3` component. A remote attacker could exploit t… |
CVE-2026-1766 | Medium | 5.6 | 2026-06-16 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buff… |
CVE-2026-1765 | Medium | 5.6 | 2026-06-16 | A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow… |
CVE-2026-1764 | Medium | 5.6 | 2026-06-16 | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags… |
CVE-2026-53705 | High | 7.6 | 2026-06-15 | A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer… |
CVE-2026-53704 | High | 7.1 | 2026-06-15 | A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO met… |
CVE-2026-53703 | High | 7.1 | 2026-06-15 | A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media propert… |
CVE-2026-52722 | High | 7.1 | 2026-06-15 | A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer p… |
CVE-2026-52721 | Medium | 5.3 | 2026-06-15 | Multiple out-of-bounds read vulnerabilities were found in GStreamer's pcapparse element. Malformed PCAP records can trigger reads beyond buffer boundaries duri… |
CVE-2026-52720 | High | 8.8 | 2026-06-15 | A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than indivi… |
CVE-2026-52719 | High | 7.1 | 2026-06-15 | An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bits… |
CVE-2026-52718 | Medium | 6.5 | 2026-06-15 | A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() function passes a byte… |
CVE-2026-44188 | Medium | 5.3 | 2026-06-15 | A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access… |
CVE-2026-54231 | Medium | 5.5 | 2026-06-13 | A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log en… |
CVE-2026-54230 | High | 7.0 | 2026-06-13 | A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirectio… |
CVE-2026-54229 | High | 7.0 | 2026-06-13 | A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd… |
CVE-2026-54228 | High | 7.8 | 2026-06-13 | A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-crea… |
CVE-2026-44172 | Critical | 9.1 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping i… |
CVE-2026-48914 | Medium | 6.7 | 2026-06-12 | A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data… |
CVE-2026-53702 | Medium | 6.5 | 2026-06-11 | A stack buffer overflow flaw was found in the GStreamer H.265 codec parser library (gst-plugins-bad). When parsing a buffering period SEI message, the parser u… |
CVE-2026-53701 | Medium | 6.5 | 2026-06-11 | An out-of-bounds write vulnerability was found in GStreamer's H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing… |
CVE-2026-11774 | High | 7.6 | 2026-06-11 | An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), adding sizeof(uint32_t) to a crafted… |
CVE-2026-11986 | Medium | 4.9 | 2026-06-11 | A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certai… |
CVE-2026-44495 | High | 7.0 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in reques… |
CVE-2026-11850 | Medium | 5.0 | 2026-06-11 | An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function perfo… |
CVE-2026-46625 | High | 7.5 | 2026-06-10 | JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with fo… |
CVE-2026-6893 | High | 7.5 | 2026-06-10 | A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configur… |
CVE-2026-11884 | Medium | 6.5 | 2026-06-10 | A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior (SUP) field length is omitted from buf… |
CVE-2026-11837 | High | 7.3 | 2026-06-10 | A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os… |
CVE-2026-41731 | High | 8.1 | 2026-06-10 | JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any… |
CVE-2025-71319 | High | 7.5 | 2026-06-09 | image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a spe… |
CVE-2026-11793 | Medium | 4.9 | 2026-06-09 | A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte s… |
CVE-2026-11792 | Low | 3.3 | 2026-06-09 | A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a… |
CVE-2026-11790 | Medium | 4.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from store… |
CVE-2026-11789 | Medium | 4.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted passwo… |
CVE-2026-11788 | Medium | 5.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauth… |
CVE-2026-11787 | Medium | 5.0 | 2026-06-09 | A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer… |
CVE-2026-11786 | Low | 1.9 | 2026-06-09 | A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during d… |
CVE-2026-11785 | Medium | 4.3 | 2026-06-09 | A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed… |
CVE-2026-52902 | Medium | 4.7 | 2026-06-09 | A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to cra… |
CVE-2026-11611 | Medium | 6.5 | 2026-06-08 | A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stop… |
CVE-2026-11569 | Medium | 5.4 | 2026-06-08 | A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload… |
CVE-2026-3238 | High | 7.5 | 2026-06-08 | A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types d… |
CVE-2026-50264 | High | 7.8 | 2026-06-05 | An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBa… |
CVE-2026-50263 | Medium | 5.5 | 2026-06-05 | A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window att… |
CVE-2026-50262 | Medium | 5.5 | 2026-06-05 | An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a clien… |
CVE-2026-50261 | High | 7.8 | 2026-06-05 | A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-… |
CVE-2026-50260 | High | 7.8 | 2026-06-05 | A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers c… |
CVE-2026-50259 | High | 7.8 | 2026-06-05 | A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed b… |
CVE-2026-50258 | High | 7.8 | 2026-06-05 | A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGrou… |
CVE-2026-50257 | High | 7.8 | 2026-06-05 | A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-aft… |
CVE-2026-50256 | High | 7.8 | 2026-06-05 | A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name… |
CVE-2026-11332 | High | 7.8 | 2026-06-05 | A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to… |
CVE-2026-9088 | Low | 2.7 | 2026-06-05 | A flaw was found in org.keycloak.services. An administrator with delegated access to read group memberships and users can bypass user profile permissions by ac… |
CVE-2026-10843 | High | 7.2 | 2026-06-04 | A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are provisioned with account-wide scope for de… |
CVE-2026-10840 | High | 7.1 | 2026-06-04 | A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to… |
CVE-2026-10805 | Medium | 6.7 | 2026-06-04 | A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufac… |
CVE-2026-1784 | High | 8.8 | 2026-06-02 | The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec… |
CVE-2026-5419 | Low | 3.7 | 2026-06-01 | A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacke… |
CVE-2026-43958 | High | 7.8 | 2026-06-01 | A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending… |
CVE-2026-10118 | High | 7.8 | 2026-06-01 | A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers… |
CVE-2026-10533 | Medium | 5.0 | 2026-06-01 | A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, and Kubernetes events… |
CVE-2026-10101 | Medium | 6.3 | 2026-05-29 | ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace… |
CVE-2026-46579 | High | 7.4 | 2026-05-29 | A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` hea… |
CVE-2026-42965 | High | 7.7 | 2026-05-29 | A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully… |
CVE-2026-10078 | Low | 2.7 | 2026-05-29 | A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, t… |
CVE-2026-10052 | Medium | 4.1 | 2026-05-29 | A flaw was found in the Quay config-tool's LDAP and SMTP validation functions. An attacker with config editor access can exploit these functions, which make ou… |
CVE-2026-6324 | Medium | 4.8 | 2026-05-29 | A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by… |
CVE-2026-10028 | Medium | 4.3 | 2026-05-28 | A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application tha… |
CVE-2026-9804 | High | 7.7 | 2026-05-28 | A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the… |