Red Hat CVEs
2,575 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-32256Kernel: ksmbd race issue from smb2 close and logoff with multichannel
- CVE-2023-32251Kernel: ksmbd brute force delay bypass via asynchronous requests
- CVE-2025-7738Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap
- CVE-2023-2593Kernel: ksmbd memory exhaustion denial-of-service vulnerability
- CVE-2025-8283Netavark: podman: netavark may resolve hostnames to unexpected hosts
- CVE-2025-4056Glib: glib crash after long command line
- CVE-2025-5449Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service
- CVE-2025-8114Libssh: null pointer dereference in libssh kex session id calculation
- CVE-2025-6018Pam-config: lpe from unprivileged to allow_active in pam
- CVE-2025-4878Libssh: use of uninitialized variable in privatekey_from_file()
- CVE-2025-7784Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)
- CVE-2025-7519Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write
- CVE-2025-53861Aap: sensitive cookie(s) set without security flags
- CVE-2025-53862Aap: aap-gateway: automation-hub: sensitive information disclosure
- CVE-2025-6395Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()
- CVE-2025-7365Keycloak: phishing attack via email verification step in first login flow
- CVE-2025-7424Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes
- CVE-2025-7425Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr
- CVE-2025-32990Gnutls: vulnerability in gnutls certtool template parsing
- CVE-2025-32989Gnutls: vulnerability in gnutls sct extension parsing
- CVE-2025-32988Gnutls: vulnerability in gnutls othername san export
- CVE-2025-7345Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf
- CVE-2025-5987Libssh: invalid return code for chacha20 poly1305 with openssl backend
- CVE-2024-9453Jenkins-image: sensitive data disclosure when using openshift jenkins image
- CVE-2025-5351Libssh: double free vulnerability in libssh key export functions
- CVE-2025-5372Libssh: incorrect return code handling in ssh_kdf() in libssh
- CVE-2025-6017Rhacm: users with clusterreader role can see credentials from managed-clusters
- CVE-2025-6920Ai-inference-server: authentication bypass via unprotected inference endpoint in api
- CVE-2025-49520Event-driven-ansible: authenticated argument injection in git url in eda project creation
- CVE-2025-49521Event-driven-ansible: template injection via git branch and refspec in eda projects