Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-71467Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: websocket header spoofing
- CVE-2026-19078Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.
- CVE-2026-14180Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap
- CVE-2026-19546Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute
- CVE-2026-50236Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console
- CVE-2026-50237Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console
- CVE-2026-71218Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion
- CVE-2026-71217Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion
- CVE-2026-15567Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener
- CVE-2026-15565Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method
- CVE-2026-15563Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos
- CVE-2026-15562Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service
- CVE-2026-15561Undertow-core: oom via missing limits in chunked trailer in eap's undertow
- CVE-2026-15560Openjdk-orb: unauthed class loading via iiop in eap
- CVE-2026-15556Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions
- CVE-2026-15555Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
- CVE-2026-15554Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery
- CVE-2026-10579Picketlink-federation: auth bypass in picketlink saml unsolicited-response
- CVE-2026-72693Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
- CVE-2026-72694Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
- CVE-2026-19519Claircore: claircore: denial of service via unchecked type assertion in rpm header parser
- CVE-2026-19391Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded…
- CVE-2026-24330Wildfly-core: wildfly: arbitrary file read via malicious archive deployment
- CVE-2026-24329Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.
- CVE-2026-6426Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
- CVE-2026-19411Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null
- CVE-2026-18620Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy
- CVE-2026-18618Ml-metdata: bundled grpc 1.46.3 (2022) with published http/2 dos cves — directly reachable on listener
- CVE-2026-18611Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials
- CVE-2026-63622Libvirt: swtpm privilege escalation via symlink following