Red Hat vulnerabilities
2,567 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-18938P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems
- CVE-2026-19079Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation
- CVE-2026-7867Udisks2: udisks2: local privilege escalation via as-user option spoofing
- CVE-2026-18649Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders
- CVE-2026-18967Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow
- CVE-2026-18839Popt-devel: popt-static: size_t underflow in singleoptionhelp
- CVE-2026-44605Rpm: heap buffer overflow in ndb slot table parsing
- CVE-2026-15572Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
- CVE-2026-16442Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
- CVE-2026-49331Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths
- CVE-2026-16100Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text
- CVE-2026-16071Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary
- CVE-2026-16102Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
- CVE-2026-15573Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
- CVE-2026-16443Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
- CVE-2026-71227Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
- CVE-2026-71226Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
- CVE-2026-71225Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries
- CVE-2026-10090Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription
- CVE-2026-10059Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token
- CVE-2026-18103Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi
- CVE-2026-68743Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1
- CVE-2026-70368Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message
- CVE-2026-70367Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services
- CVE-2026-18739Popt-devel: popt-static: off-by-one in poptstuffargs
- CVE-2026-68744Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply
- CVE-2026-18569Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens
- CVE-2026-42169Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)
- CVE-2026-17614Wildfly-core: path traversal on wildfly domain controller
- CVE-2026-18477Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape