Red Hat CVEs
2,570 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-6384Gimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing
- CVE-2026-40919Gimp: gimp: denial of service via specially crafted seattle filmworks file
- CVE-2026-40918Gimp: gimp: denial of service via crafted pvr image file
- CVE-2026-40917Gimp: gimp: application crashes or information disclosure via crafted icns image files
- CVE-2026-40916Gimp: gimp: denial of service due to stack buffer overflow in tim image loader
- CVE-2026-40915Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader
- CVE-2026-6245Sssd: out-of-bounds read in the sssd
- CVE-2026-6383Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation
- CVE-2026-37980Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page
- CVE-2026-5483Odh-dashboard: odh dashboard kubernetes service account exposure
- CVE-2026-1584Gnutls: gnutls: remote denial of service via crafted clienthello with invalid psk binder
- CVE-2026-4878Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()
- CVE-2026-32591Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration
- CVE-2026-32590Mirror-registry: remote code execution using pickle deserialization
- CVE-2026-32589Mirror-registry: quay: insecure direct object reference in blobupload
- CVE-2025-14243Mirror-registry: openshift mirror registry: user enumeration via authentication error messages
- CVE-2026-2377Mirror-registry: quay: quay: server-side request forgery via log export functionality
- CVE-2025-58713Rhpam: privilege escalation via excessive /etc/passwd permissions
- CVE-2025-57853Web-terminal: privilege escalation via excessive /etc/passwd permissions
- CVE-2025-57854Osus-operator: privilege escalation via excessive /etc/passwd permissions
- CVE-2025-57851Mce: privilege escalation via excessive /etc/passwd permissions
- CVE-2025-57847Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions
- CVE-2025-14821Libssh: libssh: insecure default configuration leads to local man-in-the-middle attacks on windows
- CVE-2026-4631Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
- CVE-2026-5745Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive
- CVE-2026-4740Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation
- CVE-2026-5704Tar: tar: hidden file injection via crafted archives
- CVE-2026-5673Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing
- CVE-2026-37977Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim
- CVE-2026-3184Util-linux: util-linux: access control bypass due to improper hostname canonicalization