Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-19816PackageKit: dnf5 backend ignores SIMULATE on RepoRemove
- CVE-2026-90996Sssd: sssd: denial of service in nss responder via crafted zero-length requests
- CVE-2026-90995Sssd: sssd: local denial of service due to null pointer dereference in pam responder
- CVE-2026-90994Sssd: sssd: denial of service via malformed pam v1 requests
- CVE-2026-90463Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)
- CVE-2026-90947Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file
- CVE-2026-90949Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch
- CVE-2026-90948Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions
- CVE-2026-89329Device-mapper-multipath: local denial of service via blocking ipc send operations
- CVE-2026-18495Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough
- CVE-2026-89298Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get
- CVE-2026-77159Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
- CVE-2026-89060Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references
- CVE-2026-88914Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser
- CVE-2026-88924Gvfs: gvfs-admin socket ownership race permits local root
- CVE-2026-88859Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
- CVE-2026-84828Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
- CVE-2026-88265Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown
- CVE-2026-88264Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs
- CVE-2026-84042Crun: crun: rootful krun with passt executes container payload as host root
- CVE-2026-88770Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts
- CVE-2026-88763Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of service
- CVE-2026-18147Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
- CVE-2026-87876Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)
- CVE-2026-87872Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with no override, enabling tls man-in-the-middle and credential disclosure
- CVE-2026-87875Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound
- CVE-2026-87853Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- CVE-2026-87874Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller
- CVE-2026-87766Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
- CVE-2026-19729Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters