Red Hat CVEs
2,579 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-0456Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check
- CVE-2023-5157Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6
- CVE-2023-4065Operator: plaintext password in operator log
- CVE-2023-42753Kernel: netfilter: potential slab-out-of-bound access due to integer underflow
- CVE-2022-4318Cri-o: /etc/passwd tampering privesc
- CVE-2022-4245Codehaus-plexus: xml external entity (xxe) injection
- CVE-2022-4244Codehaus-plexus: directory traversal
- CVE-2022-4137Keycloak: reflected xss attack
- CVE-2023-4156Heap out of bound read in builtin.c
- CVE-2023-5158Possible dos from guest to host invringh_kiov_advance in vhost driver at drivers/vhost/vringh.c
- CVE-2023-5156Glibc: dos due to memory leak in getaddrinfo.c
- CVE-2023-1633Insecure barbican configuration file leaking credential
- CVE-2023-1636Incomplete container isolation
- CVE-2023-1625Information leak in api
- CVE-2023-1260Kube-apiserver: privesc
- CVE-2022-3962Kiali: error message spoofing in kiali ui
- CVE-2022-4039Rhsso-container-image: unsecured management interface exposed to adjecent network
- CVE-2022-3874Os command injection via ct_command and fcct_command
- CVE-2022-3596Instack-undercloud: rsync leaks information to undercloud
- CVE-2022-3916Keycloak: session takeover with oidc offline refreshtokens
- CVE-2023-0462Arbitrary code execution through yaml global parameters
- CVE-2023-0118Foreman: arbitrary code execution through templates
- CVE-2022-1438Keycloak: xss on impersonation under specific circumstances
- CVE-2023-4853Quarkus: http security policy bypass
- CVE-2023-4806Glibc: potential use-after-free in getaddrinfo()
- CVE-2023-4527Glibc: stack read overflow in getaddrinfo in no-aaaa mode
- CVE-2022-3261Plain-text passwords saved in /var/log/messages
- CVE-2023-0813Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced
- CVE-2023-0923Odh-notebook-controller-container: missing authorization allows for file contents disclosure
- CVE-2022-3466Cri-o: security regression of cve-2022-27652