Red Hat CVEs
2,570 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-33845Gnutls: gnutls: denial of service via dtls zero-length fragment
- CVE-2026-3832Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response
- CVE-2026-3833Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison
- CVE-2026-7500Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled
- CVE-2026-7163Assisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure
- CVE-2026-7309Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection
- CVE-2026-5265Ovn: ovn: heap over-read in icmp error response generation
- CVE-2026-5367Ovn: ovn: information disclosure via crafted dhcpv6 packets
- CVE-2026-6732Libxml2: libxml2: denial of service via crafted xsd-validated document
- CVE-2026-2708Libsoup: libsoup: http request smuggling via duplicate content-length headers
- CVE-2026-34003Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access
- CVE-2026-34001Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption
- CVE-2026-33999Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling
- CVE-2025-66286Webkitgtk: authorization bypass through webpage::send-request signal handler
- CVE-2025-13763Libopensc: opensc: multiple uses of uninitialized variable
- CVE-2026-6862Efivar: efivar: denial of service due to stack overflow in device path node parsing
- CVE-2026-6861Emacs: emacs: memory corruption vulnerability when processing svg css
- CVE-2026-6859Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true`
- CVE-2026-6857Camel-infinispan: camel-infinispan: remote code execution via unsafe deserialization
- CVE-2026-6855Instructlab: instructlab: path traversal allows arbitrary directory creation and file write
- CVE-2026-6848Quay: red hat quay: authentication bypass allows privileged actions without valid credentials
- CVE-2026-6846Binutils: binutils: arbitrary code execution via malformed xcoff object file processing
- CVE-2026-6844Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files
- CVE-2026-6843Nano: nano: format string vulnerability leads to denial of service
- CVE-2026-6845Binutils: binutils: denial of service via crafted elf file
- CVE-2026-6842Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions
- CVE-2026-6507Dnsmasq: dnsmasq: denial of service due to out-of-bounds write in dhcp bootreply processing
- CVE-2026-6494Aap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized input
- CVE-2026-6388Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation
- CVE-2026-6385Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser