# cve.now: Red Hat

The newest entries naming Red Hat as an affected vendor (up to 200), of 2,566 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123084](https://cve.now/CVE-2026-123084.md): Python-pulpcore: pulpcore: header content guard jq filter exposes the content-app environment (CVSS 6.5)
- [CVE-2026-121885](https://cve.now/CVE-2026-121885.md): Podman: untrusted image labels allow auto-update to restart arbitrary systemd units (CVSS 6.5)
- [CVE-2026-120399](https://cve.now/CVE-2026-120399.md): Flightctl-api: flightctl-remote-access: flightctl: unbounded tls handshake in conncontext can block accepting connections (CVSS 7.5)
- [CVE-2026-124747](https://cve.now/CVE-2026-124747.md): Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the reported file size (CVSS 7.5)
- [CVE-2026-125709](https://cve.now/CVE-2026-125709.md): Libstdc++: overflow leaves streambuf in inconsistent state on i/o error. (CVSS 4.2)
- [CVE-2026-125707](https://cve.now/CVE-2026-125707.md): Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table (CVSS 6.1)
- [CVE-2026-125706](https://cve.now/CVE-2026-125706.md): Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing (CVSS 5.5)
- [CVE-2026-125712](https://cve.now/CVE-2026-125712.md): Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing (CVSS 7.5)
- [CVE-2026-125703](https://cve.now/CVE-2026-125703.md): Gst-plugins-bad: gst-plugins-bad: bounds check errors in mxf vanc packet handling (CVSS 5.5)
- [CVE-2026-125672](https://cve.now/CVE-2026-125672.md): Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option (CVSS 6.6)
- [CVE-2026-125704](https://cve.now/CVE-2026-125704.md): Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization (CVSS 7.5)
- [CVE-2026-125652](https://cve.now/CVE-2026-125652.md): Keycloak-services: keycloak-services: client-level mandatory pkce bypass via login-actions entry point (CVSS 6.8)
- [CVE-2026-122056](https://cve.now/CVE-2026-122056.md): Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service (CVSS 5.9)
- [CVE-2026-112314](https://cve.now/CVE-2026-112314.md): Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries (CVSS 7.5)
- [CVE-2026-112321](https://cve.now/CVE-2026-112321.md): Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth\_gssapi\_init error paths (CVSS 7.5)
- [CVE-2026-112320](https://cve.now/CVE-2026-112320.md): Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching (CVSS 7.5)
- [CVE-2026-112319](https://cve.now/CVE-2026-112319.md): Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation (CVSS 6.5)
- [CVE-2026-112318](https://cve.now/CVE-2026-112318.md): Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers (CVSS 6.5)
- [CVE-2026-112316](https://cve.now/CVE-2026-112316.md): Krb5: mit krb5 kadmind authenticated memory leak dos in xdr\_krb5\_tl\_data() decode failure (CVSS 6.5)
- [CVE-2026-112317](https://cve.now/CVE-2026-112317.md): Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path (CVSS 5.3)
- [CVE-2026-112315](https://cve.now/CVE-2026-112315.md): Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec\_gss buffer decode failure (CVSS 5.3)
- [CVE-2026-12977](https://cve.now/CVE-2026-12977.md): Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalation (CVSS 8.8)
- [CVE-2026-119079](https://cve.now/CVE-2026-119079.md): Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding (CVSS 7.5)
- [CVE-2026-112323](https://cve.now/CVE-2026-112323.md): Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth\_gssapi\_init requests (CVSS 7.5)
- [CVE-2026-112322](https://cve.now/CVE-2026-112322.md): Krb5: mit krb5 kadmind unauthenticated cpu dos via auth\_gssapi client states cleanup (CVSS 7.5)
- [CVE-2026-125041](https://cve.now/CVE-2026-125041.md): Gst-plugins-good: gst-plugins-good: qtdemux out-of-bounds heap read from invalid uncompressed video layout (CVSS 5.5)
- [CVE-2026-125040](https://cve.now/CVE-2026-125040.md): Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service (CVSS 6.5)
- [CVE-2026-84503](https://cve.now/CVE-2026-84503.md): Ansible-core: ansible-core: ansible.builtin.git invokes git without a \`--\` separator, allowing argument injection via a \`-\`-leading… (CVSS 6.7)
- [CVE-2026-125063](https://cve.now/CVE-2026-125063.md): Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web… (CVSS 4.3)
- [CVE-2026-19706](https://cve.now/CVE-2026-19706.md): Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap (CVSS 8.3)
- [CVE-2026-121611](https://cve.now/CVE-2026-121611.md): Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst\_h265\_parse\_vps() multi-hrd workaround loop (CVSS 6.5)
- [CVE-2026-121601](https://cve.now/CVE-2026-121601.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta\_id and slice index (CVSS 6.1)
- [CVE-2026-119610](https://cve.now/CVE-2026-119610.md): Gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in mtap16/mtap24 h.264 rtp depayloader via signed/unsigned… (CVSS 8.2)
- [CVE-2026-121629](https://cve.now/CVE-2026-121629.md): Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handling (CVSS 7.5)
- [CVE-2026-120984](https://cve.now/CVE-2026-120984.md): Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import (CVSS 9.1)
- [CVE-2026-83495](https://cve.now/CVE-2026-83495.md): Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration (no CVSS)
- [CVE-2026-50240](https://cve.now/CVE-2026-50240.md): Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution… (CVSS 8.8)
- [CVE-2026-123876](https://cve.now/CVE-2026-123876.md): Podman: containers-common: containers-common: default seccomp af\_vsock/netlink\_audit deny rules bypassable via 32-bit truncation (CVSS 4.4)
- [CVE-2026-120749](https://cve.now/CVE-2026-120749.md): Dbus: dbus-daemon: dbus-daemon aborts (reply\_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus (CVSS 6.2)
- [CVE-2026-83494](https://cve.now/CVE-2026-83494.md): Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug) (no CVSS)
- [CVE-2026-83493](https://cve.now/CVE-2026-83493.md): Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master (CVSS 9.1)
- [CVE-2026-9797](https://cve.now/CVE-2026-9797.md): Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator (CVSS 6.5)
- [CVE-2026-97848](https://cve.now/CVE-2026-97848.md): Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization (CVSS 6.5)
- [CVE-2026-97367](https://cve.now/CVE-2026-97367.md): Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover (CVSS 6.4)
- [CVE-2026-96547](https://cve.now/CVE-2026-96547.md): Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm\_access.roles (CVSS 6.5)
- [CVE-2026-96460](https://cve.now/CVE-2026-96460.md): Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2 (CVSS 5.4)
- [CVE-2026-92856](https://cve.now/CVE-2026-92856.md): Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints (CVSS 4.9)
- [CVE-2026-19688](https://cve.now/CVE-2026-19688.md): Keycloak-services: keycloak-services: admin api missing audience check (CVSS 6.8)
- [CVE-2026-96447](https://cve.now/CVE-2026-96447.md): Keycloak-services: keycloak-services: stateless token preferred\_username fallback enables identity rebinding (CVSS 4.2)
- [CVE-2026-109081](https://cve.now/CVE-2026-109081.md): Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint (CVSS 6.8)
- [CVE-2026-107124](https://cve.now/CVE-2026-107124.md): Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id\_token\_hint leading to account takeover (CVSS 6.4)
- [CVE-2026-121837](https://cve.now/CVE-2026-121837.md): Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort (CVSS 4.3)
- [CVE-2026-123037](https://cve.now/CVE-2026-123037.md): Ansible-core: user module generate\_ssh\_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902) (CVSS 6.7)
- [CVE-2026-97847](https://cve.now/CVE-2026-97847.md): Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain… (CVSS 7.1)
- [CVE-2026-97175](https://cve.now/CVE-2026-97175.md): Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover (CVSS 8.8)
- [CVE-2026-97174](https://cve.now/CVE-2026-97174.md): Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens (CVSS 6.8)
- [CVE-2026-96453](https://cve.now/CVE-2026-96453.md): Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates (CVSS 8.0)
- [CVE-2026-93998](https://cve.now/CVE-2026-93998.md): Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer (CVSS 7.4)
- [CVE-2026-92857](https://cve.now/CVE-2026-92857.md): Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed… (CVSS 8.1)
- [CVE-2026-92855](https://cve.now/CVE-2026-92855.md): Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession (CVSS 7.4)
- [CVE-2026-82965](https://cve.now/CVE-2026-82965.md): Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing (CVSS 7.5)
- [CVE-2026-111253](https://cve.now/CVE-2026-111253.md): Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved… (CVSS 6.6)
- [CVE-2026-123151](https://cve.now/CVE-2026-123151.md): Gdb: gdb: stack buffer overflow in parse\_tsv\_definition via stale rs-\>buf tail (CVSS 7.5)
- [CVE-2026-121997](https://cve.now/CVE-2026-121997.md): Gdb: gdbserver: heap buffer overflow in cmd\_qtdpsrc via qtdpsrc declared/actual length mismatch (CVSS 8.1)
- [CVE-2026-121996](https://cve.now/CVE-2026-121996.md): Gdb: gdbserver: heap disclosure and wild pointer in gdb\_parse\_agent\_expr via untrusted agent-expression length (CVSS 8.2)
- [CVE-2026-121995](https://cve.now/CVE-2026-121995.md): Gdb: gdb: stack buffer overflow in parse\_tracepoint\_definition via stale rs-\>buf tail (CVSS 7.5)
- [CVE-2026-121994](https://cve.now/CVE-2026-121994.md): Gdb: gdb: stack buffer overflow in fetch\_register\_using\_p via unchecked p-reply length (CVSS 8.8)
- [CVE-2026-114232](https://cve.now/CVE-2026-114232.md): Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access (CVSS 8.1)
- [CVE-2026-112208](https://cve.now/CVE-2026-112208.md): Keycloak-services: keycloak-services: account takeover via stale sso\_auth note in organization identity-first login (CVSS 8.1)
- [CVE-2026-110932](https://cve.now/CVE-2026-110932.md): Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cache (CVSS 7.5)
- [CVE-2026-110931](https://cve.now/CVE-2026-110931.md): Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop (CVSS 7.5)
- [CVE-2026-107602](https://cve.now/CVE-2026-107602.md): Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop (CVSS 7.5)
- [CVE-2026-103112](https://cve.now/CVE-2026-103112.md): Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path (CVSS 7.5)
- [CVE-2026-107123](https://cve.now/CVE-2026-107123.md): Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing (CVSS 7.5)
- [CVE-2026-117691](https://cve.now/CVE-2026-117691.md): Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names (CVSS 9.1)
- [CVE-2026-107912](https://cve.now/CVE-2026-107912.md): Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw (CVSS 7.7)
- [CVE-2026-123036](https://cve.now/CVE-2026-123036.md): A flaw was found in ansible-core. (CVSS 5.5)
- [CVE-2026-121621](https://cve.now/CVE-2026-121621.md): Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy… (CVSS 8.8)
- [CVE-2026-82976](https://cve.now/CVE-2026-82976.md): Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster… (CVSS 7.1)
- [CVE-2026-121259](https://cve.now/CVE-2026-121259.md): Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimator (CVSS 6.5)
- [CVE-2026-119843](https://cve.now/CVE-2026-119843.md): Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tags (CVSS 6.5)
- [CVE-2026-120971](https://cve.now/CVE-2026-120971.md): Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses (CVSS 5.3)
- [CVE-2026-120831](https://cve.now/CVE-2026-120831.md): Libslirp: libslirp: queue pointer corruption in if\_output() leading to denial of service (CVSS 6.5)
- [CVE-2026-120830](https://cve.now/CVE-2026-120830.md): Libslirp: libslirp: out-of-bounds heap read in icmp\_forward\_error() leading to information disclosure (CVSS 7.4)
- [CVE-2026-120740](https://cve.now/CVE-2026-120740.md): Hivex: hivex: denial of service via out-of-bounds read in big-data block processing (CVSS 2.0)
- [CVE-2026-120194](https://cve.now/CVE-2026-120194.md): Json-glib: json-glib: infinite loop in json\_path\_query() with negative jsonpath slice step (CVSS 7.5)
- [CVE-2026-119842](https://cve.now/CVE-2026-119842.md): Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check (CVSS 6.5)
- [CVE-2026-119727](https://cve.now/CVE-2026-119727.md): Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation (CVSS 6.5)
- [CVE-2026-119729](https://cve.now/CVE-2026-119729.md): Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service (CVSS 6.5)
- [CVE-2026-119728](https://cve.now/CVE-2026-119728.md): Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure (CVSS 6.5)
- [CVE-2026-119777](https://cve.now/CVE-2026-119777.md): Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser (CVSS 8.8)
- [CVE-2026-119542](https://cve.now/CVE-2026-119542.md): Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror (CVSS 4.3)
- [CVE-2026-119528](https://cve.now/CVE-2026-119528.md): Gimp: gimp: stack buffer overflow in psd image resource header loader (CVSS 7.8)
- [CVE-2026-115456](https://cve.now/CVE-2026-115456.md): Gcc: out-of-bounds read in std::from\_chars (CVSS 3.7)
- [CVE-2026-115455](https://cve.now/CVE-2026-115455.md): Gcc: stack overflow in std::bitset on libstdc++ (CVSS 6.5)
- [CVE-2026-114691](https://cve.now/CVE-2026-114691.md): Gcc: integer wrap in \`std (CVSS 5.9)
- [CVE-2026-114690](https://cve.now/CVE-2026-114690.md): Gcc: confirmed out-of-bounds read/write in libstdc++ parallel \`std (CVSS 6.2)
- [CVE-2026-118593](https://cve.now/CVE-2026-118593.md): Kernel: local\_bh imbalance in seg6\_input\_core() drop path (incomplete fix for cve-2026-46099) (CVSS 5.9)
- [CVE-2026-118952](https://cve.now/CVE-2026-118952.md): Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules (CVSS 6.5)
- [CVE-2026-103963](https://cve.now/CVE-2026-103963.md): Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service (CVSS 7.5)
- [CVE-2026-118475](https://cve.now/CVE-2026-118475.md): Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk (CVSS 3.6)
- [CVE-2026-112922](https://cve.now/CVE-2026-112922.md): Ghostscript: out-of-bounds read in ghostscript shade\_next\_color via integer overflow of indexed color index in mesh shading (CVSS 3.3)
- [CVE-2026-91920](https://cve.now/CVE-2026-91920.md): Undertow: undertow: chunkreader message length permits chunk-size overflow (CVSS 6.5)
- [CVE-2026-110133](https://cve.now/CVE-2026-110133.md): Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback (CVSS 5.8)
- [CVE-2026-118959](https://cve.now/CVE-2026-118959.md): Keycloak-services: keycloak-services: required actions bypassed via kc\_action parameter (CVSS 5.4)
- [CVE-2026-118947](https://cve.now/CVE-2026-118947.md): Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor (CVSS 4.3)
- [CVE-2026-92092](https://cve.now/CVE-2026-92092.md): Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification (CVSS 7.4)
- [CVE-2026-118425](https://cve.now/CVE-2026-118425.md): Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback (CVSS 6.8)
- [CVE-2026-93009](https://cve.now/CVE-2026-93009.md): Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder (CVSS 4.3)
- [CVE-2026-93010](https://cve.now/CVE-2026-93010.md): Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check (CVSS 4.3)
- [CVE-2026-93006](https://cve.now/CVE-2026-93006.md): Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content (CVSS 6.8)
- [CVE-2026-93007](https://cve.now/CVE-2026-93007.md): Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation (CVSS 5.3)
- [CVE-2026-93011](https://cve.now/CVE-2026-93011.md): Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to\_wire/from\_wire transforms (CVSS 5.3)
- [CVE-2026-93008](https://cve.now/CVE-2026-93008.md): Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations (CVSS 6.8)
- [CVE-2026-85498](https://cve.now/CVE-2026-85498.md): Polkit: regression in cve-2026-4897 fix (polkit read\_cookie()) - stack buffer underflow (CVSS 3.5)
- [CVE-2026-118030](https://cve.now/CVE-2026-118030.md): Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins (CVSS 4.2)
- [CVE-2026-117859](https://cve.now/CVE-2026-117859.md): Keycloak-services: keycloak-services: par single-use bypass via flow restart (CVSS 5.4)
- [CVE-2026-117688](https://cve.now/CVE-2026-117688.md): Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration (CVSS 5.3)
- [CVE-2026-117548](https://cve.now/CVE-2026-117548.md): 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service (CVSS 6.5)
- [CVE-2026-117627](https://cve.now/CVE-2026-117627.md): Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions (CVSS 5.4)
- [CVE-2026-114488](https://cve.now/CVE-2026-114488.md): Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without… (CVSS 7.4)
- [CVE-2026-19610](https://cve.now/CVE-2026-19610.md): Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean (CVSS 6.5)
- [CVE-2026-15564](https://cve.now/CVE-2026-15564.md): Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization (CVSS 7.4)
- [CVE-2026-117574](https://cve.now/CVE-2026-117574.md): Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no… (CVSS 9.1)
- [CVE-2026-13451](https://cve.now/CVE-2026-13451.md): Kserve: kserve: server-side request forgery via malicious storageuri (CVSS 7.7)
- [CVE-2026-109411](https://cve.now/CVE-2026-109411.md): Samba: access control bypass via vfs\_ceph\_rgw case-insensitive open (CVSS 8.1)
- [CVE-2026-84725](https://cve.now/CVE-2026-84725.md): Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap (CVSS 8.1)
- [CVE-2026-92171](https://cve.now/CVE-2026-92171.md): Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store (CVSS 6.5)
- [CVE-2026-116497](https://cve.now/CVE-2026-116497.md): Gssproxy: gssproxy: null pointer dereference in gssx\_init\_sec\_context crashes daemon (CVSS 5.5)
- [CVE-2026-115486](https://cve.now/CVE-2026-115486.md): Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning (CVSS 7.1)
- [CVE-2026-115485](https://cve.now/CVE-2026-115485.md): Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio (CVSS 6.3)
- [CVE-2026-115484](https://cve.now/CVE-2026-115484.md): Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse\_msg (CVSS 7.6)
- [CVE-2026-115449](https://cve.now/CVE-2026-115449.md): Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest (CVSS 3.5)
- [CVE-2026-115221](https://cve.now/CVE-2026-115221.md): Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership (CVSS 5.4)
- [CVE-2026-115424](https://cve.now/CVE-2026-115424.md): Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination (CVSS 5.5)
- [CVE-2026-111079](https://cve.now/CVE-2026-111079.md): Goose: goose: shell history and environment leak via terminal integration (CVSS 7.4)
- [CVE-2026-115207](https://cve.now/CVE-2026-115207.md): Patch: filename validation bypass in reversal fallback allows file creation outside the working directory (CVSS 5.5)
- [CVE-2026-114406](https://cve.now/CVE-2026-114406.md): Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns (CVSS 6.8)
- [CVE-2026-85518](https://cve.now/CVE-2026-85518.md): Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition (CVSS 6.1)
- [CVE-2026-114438](https://cve.now/CVE-2026-114438.md): Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering (CVSS 4.2)
- [CVE-2026-110744](https://cve.now/CVE-2026-110744.md): Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide (CVSS 7.2)
- [CVE-2026-114370](https://cve.now/CVE-2026-114370.md): Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal (CVSS 3.7)
- [CVE-2026-114236](https://cve.now/CVE-2026-114236.md): Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers (CVSS 3.3)
- [CVE-2026-17557](https://cve.now/CVE-2026-17557.md): Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding (CVSS 6.5)
- [CVE-2026-92824](https://cve.now/CVE-2026-92824.md): Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts (CVSS 6.2)
- [CVE-2026-92822](https://cve.now/CVE-2026-92822.md): Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml (CVSS 6.2)
- [CVE-2026-92823](https://cve.now/CVE-2026-92823.md): Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml (CVSS 6.2)
- [CVE-2026-114038](https://cve.now/CVE-2026-114038.md): Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string (CVSS 5.1)
- [CVE-2026-105941](https://cve.now/CVE-2026-105941.md): Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname (CVSS 8.1)
- [CVE-2026-105949](https://cve.now/CVE-2026-105949.md): Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all… (CVSS 8.8)
- [CVE-2026-105312](https://cve.now/CVE-2026-105312.md): Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables… (CVSS 9.9)
- [CVE-2026-105311](https://cve.now/CVE-2026-105311.md): Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy (CVSS 7.7)
- [CVE-2026-113496](https://cve.now/CVE-2026-113496.md): Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments (CVSS 5.0)
- [CVE-2026-113495](https://cve.now/CVE-2026-113495.md): Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments (CVSS 5.0)
- [CVE-2026-112177](https://cve.now/CVE-2026-112177.md): Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8 (CVSS 7.3)
- [CVE-2026-112261](https://cve.now/CVE-2026-112261.md): Gimp: gimp: use-after-free in xcf loader via prop\_selected\_path (CVSS 7.8)
- [CVE-2026-112258](https://cve.now/CVE-2026-112258.md): Gimp: gimp: use-after-free in xcf loader via prop\_linked and prop\_selection on channels (CVSS 7.8)
- [CVE-2026-112257](https://cve.now/CVE-2026-112257.md): Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load\_resource\_1033) (CVSS 7.8)
- [CVE-2026-112260](https://cve.now/CVE-2026-112260.md): Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing (CVSS 7.1)
- [CVE-2026-112259](https://cve.now/CVE-2026-112259.md): Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import (CVSS 5.5)
- [CVE-2026-112214](https://cve.now/CVE-2026-112214.md): Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser (CVSS 6.5)
- [CVE-2026-103314](https://cve.now/CVE-2026-103314.md): Stackrox: stackrox: saml response replay allows multiple central authentication tokens (CVSS 7.4)
- [CVE-2026-112210](https://cve.now/CVE-2026-112210.md): Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service (CVSS 6.0)
- [CVE-2026-16460](https://cve.now/CVE-2026-16460.md): Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization (CVSS 7.4)
- [CVE-2026-89096](https://cve.now/CVE-2026-89096.md): Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd (CVSS 5.9)
- [CVE-2026-89088](https://cve.now/CVE-2026-89088.md): Parted: parted: denial of service via heap buffer overflow during fat16 resize (CVSS 5.5)
- [CVE-2026-89085](https://cve.now/CVE-2026-89085.md): Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image (CVSS 6.6)
- [CVE-2026-111802](https://cve.now/CVE-2026-111802.md): Nautilus: nautilus: arbitrary file deletion via trash symlink (CVSS 6.6)
- [CVE-2026-17591](https://cve.now/CVE-2026-17591.md): Libarchive: libarchive: use-after-free via aliased mac metadata copy (CVSS 3.6)
- [CVE-2026-62438](https://cve.now/CVE-2026-62438.md): Gimp: gimp: paa integer overflow out-of-bounds read (CVSS 6.1)
- [CVE-2026-62439](https://cve.now/CVE-2026-62439.md): Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability (CVSS 7.0)
- [CVE-2026-85977](https://cve.now/CVE-2026-85977.md): Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding (CVSS 5.3)
- [CVE-2026-85231](https://cve.now/CVE-2026-85231.md): Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec\_gss decoding (CVSS 6.5)
- [CVE-2026-89098](https://cve.now/CVE-2026-89098.md): Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd (CVSS 5.5)
- [CVE-2026-111581](https://cve.now/CVE-2026-111581.md): Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method (CVSS 3.3)
- [CVE-2026-111555](https://cve.now/CVE-2026-111555.md): Luksmeta: missing slot-range validation permits out-of-gap device i/o (CVSS 6.0)
- [CVE-2026-105958](https://cve.now/CVE-2026-105958.md): Spice-server: spice: heap oob read/write via unchecked migration data offsets (CVSS 7.5)
- [CVE-2026-105959](https://cve.now/CVE-2026-105959.md): Spice-server: spice: heap buffer overflow via glz dictionary max\_encoders integer truncation (CVSS 7.5)
- [CVE-2026-104715](https://cve.now/CVE-2026-104715.md): Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass (CVSS 7.8)
- [CVE-2026-84823](https://cve.now/CVE-2026-84823.md): Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role (CVSS 7.1)
- [CVE-2026-109131](https://cve.now/CVE-2026-109131.md): Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl) (CVSS 5.4)
- [CVE-2026-108334](https://cve.now/CVE-2026-108334.md): Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator… (CVSS 7.4)
- [CVE-2026-85634](https://cve.now/CVE-2026-85634.md): Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name (CVSS 8.8)
- [CVE-2026-92982](https://cve.now/CVE-2026-92982.md): Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection (CVSS 8.5)
- [CVE-2026-110777](https://cve.now/CVE-2026-110777.md): Evolution-data-server: local file disclosure via attach file:// uris (CVSS 5.7)
- [CVE-2026-86849](https://cve.now/CVE-2026-86849.md): Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVSS 6.5)
- [CVE-2026-86856](https://cve.now/CVE-2026-86856.md): Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver (CVSS 6.5)
- [CVE-2026-86847](https://cve.now/CVE-2026-86847.md): Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVSS 6.5)
- [CVE-2026-86846](https://cve.now/CVE-2026-86846.md): Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVSS 6.5)
- [CVE-2026-86845](https://cve.now/CVE-2026-86845.md): Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVSS 6.5)
- [CVE-2026-86566](https://cve.now/CVE-2026-86566.md): Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings) (CVSS 6.5)
- [CVE-2026-86848](https://cve.now/CVE-2026-86848.md): Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVSS 8.8)
- [CVE-2026-86567](https://cve.now/CVE-2026-86567.md): Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap (CVSS 8.8)
- [CVE-2026-100236](https://cve.now/CVE-2026-100236.md): Dpdk: dpdk: heap out-of-bounds read/write in gso header copy (CVSS 8.6)
- [CVE-2026-86565](https://cve.now/CVE-2026-86565.md): Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVSS 8.2)
- [CVE-2026-86563](https://cve.now/CVE-2026-86563.md): Dpdk: dpdk: double offset bug in vhost log mapping calculation (CVSS 7.8)
- [CVE-2026-86562](https://cve.now/CVE-2026-86562.md): Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) (CVSS 7.8)
- [CVE-2026-86561](https://cve.now/CVE-2026-86561.md): Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup (CVSS 6.5)
- [CVE-2026-93683](https://cve.now/CVE-2026-93683.md): Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou (CVSS 6.4)
- [CVE-2026-109968](https://cve.now/CVE-2026-109968.md): Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/red-hat
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.