Red Hat vulnerabilities
2,566 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-107623Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation
- CVE-2026-107604Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints
- CVE-2026-107565Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption
- CVE-2026-93017Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader
- CVE-2026-107466Flatpak-builder: local file exfiltration via `file
- CVE-2026-107445Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass
- CVE-2026-107444Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass
- CVE-2026-107176Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret
- CVE-2026-107161Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients
- CVE-2026-106067Gimp: gimp: heap buffer overflow in hot color filter on oversized image
- CVE-2026-106066Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions
- CVE-2026-106065Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions
- CVE-2026-107174Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction
- CVE-2026-107169M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8
- CVE-2026-107167M17n-lib: heap use-after-free write in re_init_ic()
- CVE-2026-106064Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions
- CVE-2026-107170M17n-lib: null dereference in minput_open_im() after failed m17n_init()
- CVE-2026-107168M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()
- CVE-2026-107151Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests
- CVE-2026-107121Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade
- CVE-2026-103870Pulp-rpm: distribution tree publish creates directories from .treeinfo ids
- CVE-2026-103869Pulp-ansible: bearer tokens are reused across remotes in a worker
- CVE-2026-103868Pulp-container: registry credentials are reused across remotes in a worker
- CVE-2026-106061Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file
- CVE-2026-106471Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
- CVE-2026-80048Sssd: sssd-kcm: local denial of service via excessive memory preallocation
- CVE-2026-104045Sssd: sssd: denial of service via race condition in autofs responder
- CVE-2026-104046Sssd: sssd: denial of service via incomplete identity provider authentication requests
- CVE-2026-106062Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file
- CVE-2026-101258Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free