Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-73583Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr
- CVE-2026-73585Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack
- CVE-2026-18728Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing
- CVE-2026-71846Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege
- CVE-2026-71469Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos
- CVE-2026-71471Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image
- CVE-2026-71473Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke
- CVE-2026-18727Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing
- CVE-2026-18726Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing
- CVE-2026-19654Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash…
- CVE-2026-19130Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization
- CVE-2026-13622Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host
- CVE-2026-72508Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)
- CVE-2026-73433Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write
- CVE-2026-73434Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing
- CVE-2026-73268Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection
- CVE-2026-73269Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa
- CVE-2026-19548Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing
- CVE-2026-18663389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control
- CVE-2026-64927Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy
- CVE-2026-73122Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces
- CVE-2026-66878Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration
- CVE-2026-70398Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace
- CVE-2026-72526Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation
- CVE-2026-19550Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes
- CVE-2026-71474Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response
- CVE-2026-71468Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache
- CVE-2026-71475Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path
- CVE-2026-71845Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()
- CVE-2026-71467Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing