Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-96546Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader
- CVE-2026-71465Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection…
- CVE-2026-71464Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt…
- CVE-2026-71463Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via…
- CVE-2026-96545Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader
- CVE-2026-71462Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence…
- CVE-2026-71461Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler
- CVE-2026-71460Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license…
- CVE-2026-76648Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery
- CVE-2026-96541Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline
- CVE-2026-71459Automation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes…
- CVE-2026-71458Automation-controller: automation-controller-container: automation-controller: named-url 404 body oracle enables cross-tenant resource…
- CVE-2026-88840Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello
- CVE-2026-88839Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint
- CVE-2026-88837Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication
- CVE-2026-88835Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages
- CVE-2026-88831Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
- CVE-2026-88832Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow
- CVE-2026-88830Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow
- CVE-2026-96276Flatpak: flatpak: arbitrary write in host context via flatpak build-init
- CVE-2026-96275Flatpak: flatpak: arbitrary write access as root via extra-data extraction
- CVE-2026-96512Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
- CVE-2026-96445Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers
- CVE-2026-96446Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path
- CVE-2026-96442Emacs: emacs: arbitrary code execution in flymake mode
- CVE-2026-90462Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization
- CVE-2026-94640Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service
- CVE-2026-95619Gcc: libstdc++ integer overflow in `new` operator
- CVE-2026-95508Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu
- CVE-2026-95503Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled