Red Hat CVEs
2,577 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-13484Openshift-gitops-operator-container: namespace isolation break
- CVE-2025-0754Envoyproxy: openshift service mesh 2.6.3 and 2.5.6 envoy header handling allows log injection and potential spoofing
- CVE-2025-0752Envoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized access
- CVE-2025-0750Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting
- CVE-2025-0736Org.infinispan-infinispan-parent: exposure of sensitive information in application logs
- CVE-2022-4975Rhacs: cross-site scripting in portal
- CVE-2025-0650Ovn: egress acls may be bypassed via specially crafted udp packet
- CVE-2025-0604Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak
- CVE-2024-11218Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile
- CVE-2024-12084Rsync: heap buffer overflow in rsync due to improper checksum length handling
- CVE-2024-11029Freeipa: administrative user data leaked through systemd journal
- CVE-2024-12087Rsync: path traversal vulnerability in rsync
- CVE-2025-23366Org.jboss.hal:hal-console: wildfly hal console cross-site scripting
- CVE-2024-12747Rsync: race condition in rsync handling symbolic links
- CVE-2024-12088Rsync: --safe-links option bypass leads to path traversal
- CVE-2024-12086Rsync: rsync server leaks arbitrary client files
- CVE-2024-12085Rsync: info leak via uninitialized stack contents
- CVE-2024-11736Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables
- CVE-2024-11734Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers
- CVE-2025-0306Ruby: openssl: ruby marvin attack
- CVE-2024-56827Openjpeg: heap buffer overflow in lib/openjp2/j2k.c
- CVE-2024-56826Openjpeg: heap buffer overflow in bin/common/color.c
- CVE-2024-8447Narayana: deadlock via multiple join requests sent to lra coordinator
- CVE-2024-45497Openshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentials
- CVE-2024-12582Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service
- CVE-2024-11614Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library
- CVE-2024-12698Ose-olm-catalogd-container: incomplete fix for rapid reset (cve-2023-39325/cve-2023-44487)
- CVE-2024-10973Keycloak: cli option for encrypted jgroups ignored
- CVE-2024-9779Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokens
- CVE-2024-12401Cert-manager: potential dos when parsing specially crafted pem inputs