Red Hat vulnerabilities
2,567 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-3842Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write
- CVE-2026-23538Feast: resource exhaustion via websocket endpoint
- CVE-2026-12382Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing
- CVE-2026-15779Samba-winbind: samba: pam_winbind mkhomedir chowns critical system paths without validation
- CVE-2026-15809Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env
- CVE-2026-14251Gitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potential privilege escalation and dos
- CVE-2026-15714Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart…
- CVE-2026-15713Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak
- CVE-2026-15711Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation
- CVE-2026-15709Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service
- CVE-2026-15712Soupclientmessageiohttp2: libsoup3: libsoup: http/2 goaway frame parsing heap buffer over-read via invalid nul-termination assumption
- CVE-2026-12478Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)
- CVE-2026-15416Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint
- CVE-2026-15584Redhatinsights/incluster-checks: incluster-checks: privileged host-chroot debug pods created in shared default namespace enable privilege escalation to node root
- CVE-2026-62147Tempo-operator: tempo operator: query rbac bypass
- CVE-2026-15574Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default
- CVE-2026-15143Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)
- CVE-2026-15028Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header
- CVE-2026-15378Guardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)
- CVE-2026-59692Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback
- CVE-2026-59691Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer
- CVE-2026-15154Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex
- CVE-2026-15063Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled
- CVE-2026-15044Trustyai-service-operator: trustyai service operator: unauthenticated access to ai guardrails and orchestrator apis
- CVE-2026-15041389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification
- CVE-2025-12799Jastow: jastow cross-site scripting attack due to unsanitized uri
- CVE-2026-14969389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption
- CVE-2026-14935Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check
- CVE-2026-14940389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn
- CVE-2026-11610389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind