Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-102576Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page
- CVE-2026-102295Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter
- CVE-2026-105306Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration
- CVE-2026-105302Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens
- CVE-2026-104988Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
- CVE-2026-94422xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
- CVE-2026-95512Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader
- CVE-2026-86345389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result
- CVE-2026-86344389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue
- CVE-2026-103884Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read
- CVE-2026-56098Rubygem-katello: improper authorization logic allows resource enumeration
- CVE-2026-56097Rubygem-katello: sql injection in registry proxy via labels
- CVE-2026-12542Foreman: command injection in foreman-tail
- CVE-2026-12545Rubygem-hammer_cli: command injection via insecure editor invocation
- CVE-2026-96658Foreman: foreman: arbitrary code execution via safemode sandbox bypass
- CVE-2026-96659Foreman: excessive permissions for viewer role on preview
- CVE-2026-12544Foreman: ssti and insecure deserialization in foreman-rake configuration
- CVE-2026-12541Foreman: command injection in foreman-rake database tasks
- CVE-2026-12540Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
- CVE-2026-12423Foreman: unauthenticated information disclosure via provisioning token validation flaw
- CVE-2026-12405Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
- CVE-2026-103754Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory
- CVE-2026-96577Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled
- CVE-2026-83589Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
- CVE-2026-103641Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder
- CVE-2026-103399Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body
- CVE-2026-101295Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction
- CVE-2026-103242Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
- CVE-2026-62146Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket
- CVE-2026-102560Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth