Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-102559Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
- CVE-2026-102558Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
- CVE-2026-102555Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding
- CVE-2026-102623Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume
- CVE-2026-102557Libsoup: libsoup: heap buffer overflow during websocket message reassembly
- CVE-2026-102556Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
- CVE-2026-95520Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages
- CVE-2026-102474Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation
- CVE-2026-102473Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled
- CVE-2026-97029Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group
- CVE-2026-97024Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
- CVE-2026-97027Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files
- CVE-2026-97026Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path
- CVE-2026-97025Flatpak: flatpak: world-readable oci authentication token in system-helper cache path
- CVE-2026-102010Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if
- CVE-2026-97023Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
- CVE-2026-96740Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via…
- CVE-2026-87114Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo
- CVE-2026-101333Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint
- CVE-2026-101292Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization
- CVE-2026-86330Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
- CVE-2026-96284Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following
- CVE-2026-96282Flatpak: flatpak: extension metadata path traversal file existence oracle
- CVE-2026-96283Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull
- CVE-2026-96281Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes
- CVE-2026-96280Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
- CVE-2026-96279Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks
- CVE-2026-93834Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
- CVE-2026-96448Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation
- CVE-2026-97846Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding