Red Hat CVEs
2,567 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-12892Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser
- CVE-2026-12891Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser
- CVE-2026-11820Community.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api…
- CVE-2026-11819Community.general: community.general keyring_info — os keyring passphrase returned in plaintext
- CVE-2026-9073Foreman-mcp-server: mcp server: insecure sensitive http header sanitization
- CVE-2026-12112Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse
- CVE-2026-11807Eda-server: websocket missing authorization allows credential theft via activation_id spoofing
- CVE-2026-12969Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation
- CVE-2026-10609Openshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization
- CVE-2026-55654Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel…
- CVE-2026-55655Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions
- CVE-2026-55653Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to…
- CVE-2026-12549Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver
- CVE-2026-12725Dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies
- CVE-2026-54100Windows-machine-config-operator: windows-machine-config-operator: ssh host key not verified enables credential theft
- CVE-2026-54099Windows-machine-config-operator: windows-machine-config-operator: wicd csr extra-organization allows privilege escalation to system:masters
- CVE-2026-12726Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential
- CVE-2026-56211Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames
- CVE-2026-56210Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id
- CVE-2026-56208Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
- CVE-2026-56209Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack
- CVE-2026-3195Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)
- CVE-2026-3196Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation
- CVE-2026-12706Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()
- CVE-2026-11791389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()
- CVE-2026-12505Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall
- CVE-2026-12515Katello: missing repository authorization in content_uploads exposes cross-product content existence
- CVE-2026-12528389-ds-base: 389-ds-base: heap-buffer-overflows in aclpnormalize_acltxt()
- CVE-2026-12491Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations
- CVE-2026-2604Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling