Red Hat CVEs
2,567 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-12388Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper
- CVE-2026-4629Keycloak: keycloak: privilege escalation through hardcoded role mapper injection
- CVE-2026-14209Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions
- CVE-2026-13316Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config
- CVE-2026-12610Sssd: use-after-free crash in sssd' 'sssd_pam' process
- CVE-2026-14164Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()
- CVE-2026-13757P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
- CVE-2026-12912Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image
- CVE-2026-12856Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension
- CVE-2026-13601Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications
- CVE-2026-13595Util-linux: util-linux: heap use-after-free in libblkid nested partition probing
- CVE-2026-57966Spice-vdagent: path traversal in file transfer via unsanitized filename
- CVE-2026-57965Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow
- CVE-2026-13434Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled
- CVE-2026-13322Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service
- CVE-2026-13083Pen-drive: pen-drive: stored xss via unescaped cluster data in html report
- CVE-2026-13318Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip
- CVE-2026-13218Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher
- CVE-2026-12993Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset
- CVE-2026-12992Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation
- CVE-2026-12975Apicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos
- CVE-2026-11800Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion
- CVE-2026-9083Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
- CVE-2026-9799Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass
- CVE-2026-9705Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token
- CVE-2026-9086Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass
- CVE-2026-9099Keycloak: group-admin escalation to realm-admin
- CVE-2026-9800Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison
- CVE-2026-13208Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body
- CVE-2026-13201Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption