Red Hat CVEs
2,574 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-11393Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands
- CVE-2025-13888Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs
- CVE-2025-14523Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)
- CVE-2025-14512Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow
- CVE-2025-14082Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure
- CVE-2025-14087Glib: glib: buffer underflow in gvariant parser leads to heap corruption
- CVE-2025-14104Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
- CVE-2025-66287Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash
- CVE-2025-14010Ansible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose output
- CVE-2024-3884Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
- CVE-2025-13947Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop
- CVE-2025-12744Abrt: command-injection in abrt leading to local privilege escalation
- CVE-2025-57850Codeready-ws: privilege escalation via excessive /etc/passwd permissions
- CVE-2021-4472Python-mistralclient: mistral-dashboard: local file inclusion through the 'create workbook' feature
- CVE-2025-13601Glib: integer overflow in in g_escape_uri_string()
- CVE-2025-13467Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation
- CVE-2025-13502Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos
- CVE-2025-13609Keylime: keylime: registrar allows identity takeover via duplicate uuid registration
- CVE-2025-54770Grub2: use-after-free in net_set_vlan
- CVE-2025-61664Grub2: missing unregister call for normal_exit command may lead to use-after-free
- CVE-2025-61663Grub2: missing unregister call for normal commands may lead to use-after-free
- CVE-2025-61662Grub2: missing unregister call for gettext command may lead to use-after-free
- CVE-2025-61661Grub2: grub2: out-of-bounds write via malicious usb device
- CVE-2025-54771Grub2: use-after-free in grub_file_close()
- CVE-2025-13193Libvirt: information disclosure via world-readable vm snapshots
- CVE-2025-13033Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict
- CVE-2025-11538Keycloak-server: debug default bind address
- CVE-2025-59089Python-kdcproxy: remote dos via unbounded tcp upstream buffering
- CVE-2025-2843Observability-operator: observability operator privilege escalation
- CVE-2025-59088Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv