Red Hat vulnerabilities
2,567 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-18382Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url
- CVE-2026-18378Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)
- CVE-2026-18381Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address
- CVE-2026-18369Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
- CVE-2026-16531Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet
- CVE-2026-16530Pcp: pcp: remote denial of service and information leakage
- CVE-2026-16529Pcp: pcp: denial of service due to signed integer overflow
- CVE-2026-16527Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules
- CVE-2026-16526Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability
- CVE-2026-16524Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection
- CVE-2026-18255Quay: quay: global read-only superuser can view robot account tokens
- CVE-2026-18220Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing
- CVE-2026-18201Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations
- CVE-2026-18207Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching
- CVE-2026-18107Criu: criu: container escape via rseq critical section hijack during checkpoint/restore
- CVE-2026-16313Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
- CVE-2026-18047Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash
- CVE-2026-49332Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams
- CVE-2026-17072Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing flac codec data in…
- CVE-2026-12383Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn
- CVE-2026-66759Gimp: out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted icns images
- CVE-2026-66757Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images
- CVE-2026-66758Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images
- CVE-2026-15003Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service
- CVE-2026-17527Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing…
- CVE-2026-66337Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()
- CVE-2026-66338Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
- CVE-2026-66339Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels
- CVE-2026-17107Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster
- CVE-2026-17039Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path