Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-105312Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables…
- CVE-2026-105311Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
- CVE-2026-113496Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments
- CVE-2026-113495Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments
- CVE-2026-112177Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
- CVE-2026-112261Gimp: gimp: use-after-free in xcf loader via prop_selected_path
- CVE-2026-112258Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
- CVE-2026-112257Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
- CVE-2026-112260Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
- CVE-2026-112259Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
- CVE-2026-112214Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
- CVE-2026-103314Stackrox: stackrox: saml response replay allows multiple central authentication tokens
- CVE-2026-112210Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
- CVE-2026-16460Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
- CVE-2026-89096Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
- CVE-2026-89088Parted: parted: denial of service via heap buffer overflow during fat16 resize
- CVE-2026-89085Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image
- CVE-2026-111802Nautilus: nautilus: arbitrary file deletion via trash symlink
- CVE-2026-17591Libarchive: libarchive: use-after-free via aliased mac metadata copy
- CVE-2026-62438Gimp: gimp: paa integer overflow out-of-bounds read
- CVE-2026-62439Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
- CVE-2026-85977Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding
- CVE-2026-85231Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
- CVE-2026-89098Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd
- CVE-2026-111581Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method
- CVE-2026-111555Luksmeta: missing slot-range validation permits out-of-gap device i/o
- CVE-2026-105958Spice-server: spice: heap oob read/write via unchecked migration data offsets
- CVE-2026-105959Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
- CVE-2026-104715Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
- CVE-2026-84823Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role