Red Hat CVEs
2,575 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-11060Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions
- CVE-2025-11021Libsoup: out-of-bounds read in cookie date handling of libsoup http library
- CVE-2025-60019Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via…
- CVE-2025-60018Glib-networking: out of bound reads on glib-networking through tls/openssl/gtlscertificate-openssl.c via…
- CVE-2025-10911Libxslt: use-after-free with key data stored cross-rvt
- CVE-2025-10894Nx: nx/devkit: malicious versions of nx and plugins published to npm
- CVE-2025-9900Libtiff: libtiff write-what-where
- CVE-2025-5962Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation
- CVE-2025-4953Podman: build context bind mount
- CVE-2025-8277Libssh: memory exhaustion via repeated key exchange in libssh
- CVE-2025-10044Keycloak: keycloak error_description injection on error pages
- CVE-2025-9566Podman: podman kube play command may overwrite host files
- CVE-2025-9901Libsoup: improper handling of http vary header in libsoup caching
- CVE-2025-7039Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()
- CVE-2025-9784Undertow: undertow madeyoureset http/2 ddos vulnerability
- CVE-2025-8067Udisks: out-of-bounds read in udisks daemon
- CVE-2025-9162Org.keycloak/keycloak-model-storage-service: variable injection into environment variables
- CVE-2025-8415Cryostat: authentication bypass if network policies are disabled
- CVE-2025-4877Libssh: write beyond bounds in binary to base64 conversion functions
- CVE-2025-4437Cri-o: large /etc/passwd file may lead to denial of service
- CVE-2025-7777Mirror-registry: host header injection in mirror-registry
- CVE-2025-5417Rhdh: red hat developer hub user permissions
- CVE-2023-5342Shim: expired secure boot certificate
- CVE-2025-8941Linux-pam: incomplete fix for cve-2025-6020
- CVE-2025-7195Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd
- CVE-2025-8419Org.keycloak/keycloak-services: keycloak smtp inject vulnerability
- CVE-2025-8556Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results
- CVE-2025-5988Aap-gateway: csrf origin checking is disabled
- CVE-2023-32253Kernel: deadlock in ksmbd_find_crypto_ctx()
- CVE-2023-32255Kernel: memory leak via ksmbd session setup request with unknown ntlmssp message type