Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-66786Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
- CVE-2026-84838Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
- CVE-2026-84837Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path
- CVE-2026-78409Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks
- CVE-2026-78410Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
- CVE-2026-78408Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
- CVE-2026-53683Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
- CVE-2026-82968Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers
- CVE-2026-84470Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level…
- CVE-2026-49329Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
- CVE-2026-84270Gvfs: mtp: out-of-bounds read in do_read()
- CVE-2026-84269Gvfs: afp: heap-based buffer overflow in dsi read path
- CVE-2026-84267Gvfs: sftp: uninitialized heap disclosure in read_string()
- CVE-2026-84232Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content
- CVE-2026-84268Gvfs: sftp: heap-based buffer overflow in read_reply()
- CVE-2026-84233Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
- CVE-2026-84218Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
- CVE-2026-53682Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
- CVE-2026-11873Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure
- CVE-2026-18743Popt-devel: popt-static: short realloc in poptconfigfiletostring
- CVE-2026-83596Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature
- CVE-2026-13732Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
- CVE-2026-17615Resteasy-core: resteasy sourceprovider remote unauthenticated file read
- CVE-2026-76763Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals
- CVE-2026-12894Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
- CVE-2026-81624Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite
- CVE-2026-82343Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling
- CVE-2026-82330Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check
- CVE-2026-82328Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count
- CVE-2026-82327Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data