Red Hat CVEs
2,570 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-0665Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq
- CVE-2025-8860Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback
- CVE-2025-14876Qemu-kvm: unbounded allocation in virtio-crypto
- CVE-2025-1272Kernel: secure boot does not automatically enable kernel lockdown
- CVE-2025-0577Glibc: vdso getrandom acceleration may return predictable randomness
- CVE-2026-2443Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure
- CVE-2026-26158Busybox: busybox: arbitrary file modification and privilege escalation via unvalidated tar archive entries
- CVE-2026-26157Busybox: busybox: arbitrary file overwrite and potential code execution via incomplete path sanitization
- CVE-2025-11537Keycloak-services: sensitive headers shown in the http access logs
- CVE-2025-14778Keycloak: incorrect ownership checks in /uma-policy/
- CVE-2026-1529Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation
- CVE-2026-1486Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant
- CVE-2025-14831Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification
- CVE-2026-1709Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication
- CVE-2026-0598Ansible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed api
- CVE-2026-1801Libsoup: libsoup: http request smuggling via malformed chunk headers
- CVE-2026-1760Libsoup: soupserver: denial of service via http request smuggling
- CVE-2026-1761Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response
- CVE-2026-1757Libxml2: memory leak leading to local denial of service in xmllint interactive shell
- CVE-2026-1530Fog-kubevirt: fog-kubevirt: man-in-the-middle vulnerability due to disabled certificate validation
- CVE-2026-1531Foreman-kubevirt: foreman_kubevirt: man-in-the-middle due to insecure default ssl verification
- CVE-2025-13881Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api
- CVE-2024-4027Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks
- CVE-2026-1616osim: Path Traversal via query parameters in Nginx configuration
- CVE-2026-1539Libsoup: libsoup: credential leakage via http redirects
- CVE-2026-1536Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header
- CVE-2026-1489Glib: glib: memory corruption via integer overflow in unicode case conversion
- CVE-2026-1485Glib: glib: local denial of service via buffer underflow in content type parsing
- CVE-2026-1484Glib: integer overflow leading to buffer underflow and out-of-bounds write in glib g_base64_encode()
- CVE-2026-1467Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured