Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-114488Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without…
- CVE-2026-19610Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
- CVE-2026-15564Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
- CVE-2026-117574Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no…
- CVE-2026-13451Kserve: kserve: server-side request forgery via malicious storageuri
- CVE-2026-109411Samba: access control bypass via vfs_ceph_rgw case-insensitive open
- CVE-2026-84725Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
- CVE-2026-92171Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
- CVE-2026-116497Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon
- CVE-2026-115486Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
- CVE-2026-115485Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
- CVE-2026-115484Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
- CVE-2026-115449Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
- CVE-2026-115221Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership
- CVE-2026-115424Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination
- CVE-2026-111079Goose: goose: shell history and environment leak via terminal integration
- CVE-2026-115207Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
- CVE-2026-114406Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
- CVE-2026-85518Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition
- CVE-2026-114438Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering
- CVE-2026-110744Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide
- CVE-2026-114370Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal
- CVE-2026-114236Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
- CVE-2026-17557Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
- CVE-2026-92824Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
- CVE-2026-92822Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
- CVE-2026-92823Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
- CVE-2026-114038Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string
- CVE-2026-105941Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
- CVE-2026-105949Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all…