Red Hat vulnerabilities
2,567 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-17059Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter
- CVE-2026-17048Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api
- CVE-2026-16743Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users
- CVE-2026-16730Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup
- CVE-2026-16910Quay: ssrf in red hat quay notification webhooks (slack/generic)
- CVE-2026-12353Rhcs: memory leak during https connection leads to denial of service
- CVE-2026-16768Gdk-pixbuf: out-of-bounds read in ico parser
- CVE-2026-64611Libcupsfilters: cups-filters: libcupsfilters: cpu exhaustion via infinite loop in cfieee1284normalizemakemodel()
- CVE-2026-16745Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation
- CVE-2026-6390Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.
- CVE-2026-16615Librest: weak random number generation in pkce implementation
- CVE-2026-16560389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn
- CVE-2026-44191Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code execution via command injection in configuration settings
- CVE-2026-44187Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key
- CVE-2026-44192Ansible-lightspeed: ansible lightspeed mcp server: remote code execution and data exfiltration via path traversal
- CVE-2026-44190Ansible-lightspeed: ansible lightspeed visual studio code extension: arbitrary code execution via command injection in activation script setting
- CVE-2026-44189Ansible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filename
- CVE-2026-16544Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure
- CVE-2026-16473Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame
- CVE-2026-16517Libarchive: libarchive: signed integer overflow in archive_write_zip_header
- CVE-2026-12548Libsoup: heap out-of-bounds read in libsoup due to integer truncation
- CVE-2026-12547Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch
- CVE-2026-16493Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)
- CVE-2026-59851Libssh: libssh: authentication bypass via missing gssapi principal check
- CVE-2026-59850Libssh: libssh: use-after-free via data callbacks on closed channels
- CVE-2026-59849Libssh: libssh: denial of service via automatic certificate authentication loop
- CVE-2026-59848Libssh: libssh: denial of service via sftp responses with unknown request ids
- CVE-2026-59847Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification
- CVE-2026-59846Libssh: libssh: information disclosure via proxycommand %r username expansion
- CVE-2026-16445Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module