CVEs we hold for Red
Records whose assigning authority named Red as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-9804Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file readRed Hat OpenShift Virtualization 4
CVE-2026-9803Keycloak: keycloak: denial of service via malformed authorization headerRed Hat build of Keycloak 26.6.3
CVE-2026-9802Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restartRed Hat build of Keycloak 26.6.3
CVE-2026-9801Keycloak: keycloak: denial of service via malformed ldap password policy responseRed Hat build of Keycloak 26.6.3
CVE-2026-9800Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparisonRed Hat Single Sign-On 7
CVE-2026-9799Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypassRed Hat build of Keycloak 26.6.4
CVE-2026-9798Keycloak: keycloak: brute-force protection bypass in ciba flowRed Hat build of Keycloak 26.6.5
CVE-2026-9796Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerabilityRed Hat Build of Keycloak
CVE-2026-9795Keycloak: keycloak: privilege escalation via improper scope mapping enforcementRed Hat build of Keycloak 26.6.4
CVE-2026-9794Keycloak: keycloak: information disclosure via saml ecp endpointRed Hat build of Keycloak 26.6.3
CVE-2026-9793Keycloak: keycloak: security policy bypass in jwe-encrypted request object processingRed Hat build of Keycloak 26.6.5
CVE-2026-9792Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisitionRed Hat build of Keycloak 26.6.3
CVE-2026-9791Keycloak-rhel9: organization data leak after feature disabled in keycloakRed Hat build of Keycloak 26.6.3
CVE-2026-97846Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key bindingRed Hat Single Sign-On 7
CVE-2026-97311Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorizationRed Hat Single Sign-On 7
CVE-2026-97185Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset fileRed Hat Enterprise Linux 8
CVE-2026-97177Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permissionRed Hat Single Sign-On 7
CVE-2026-97176Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticatorRed Hat Single Sign-On 7
CVE-2026-9705Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access tokenRed Hat build of Keycloak 26.6.4
CVE-2026-9704Keycloak: keycloak: privilege escalation due to oversized subject_token jwtRed Hat build of Keycloak 26.6.3
CVE-2026-97029Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process groupRed Hat Enterprise Linux 9
CVE-2026-97027Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service filesRed Hat Enterprise Linux 9
CVE-2026-97026Flatpak: flatpak: world-writable temporary child repositories in system-helper cache pathRed Hat Enterprise Linux 9
CVE-2026-97025Flatpak: flatpak: world-readable oci authentication token in system-helper cache pathRed Hat Enterprise Linux 9
CVE-2026-97024Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etcRed Hat Enterprise Linux 9
CVE-2026-97023Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/binRed Hat Enterprise Linux 9
CVE-2026-9689Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter…Red Hat build of Keycloak 26.6.5
CVE-2026-96889Librsvg: use-after-free when xml includes have duplicated entitiesRed Hat Enterprise Linux 9
CVE-2026-96740Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token…Red Hat streams for Apache Kafka 3
CVE-2026-96659Foreman: excessive permissions for viewer role on previewRed Hat Satellite 6.19 for RHEL 9
CVE-2026-96658Foreman: foreman: arbitrary code execution via safemode sandbox bypassRed Hat Satellite 6.19 for RHEL 9
CVE-2026-96577Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete…Red Hat OpenShift Container Platform 2
CVE-2026-96546Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loaderRed Hat Enterprise Linux 9
CVE-2026-96545Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loaderRed Hat Enterprise Linux 9
CVE-2026-96541Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadlineRed Hat Enterprise Linux 9
CVE-2026-96512Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorizationRed Hat Enterprise Linux 7
CVE-2026-96448Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalationRed Hat Single Sign-On 7
CVE-2026-96446Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication pathRed Hat Single Sign-On 7
CVE-2026-96445Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headersRed Hat Single Sign-On 7
CVE-2026-96284Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink followingRed Hat Enterprise Linux 9
CVE-2026-96283Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pullRed Hat Enterprise Linux 9
CVE-2026-96282Flatpak: flatpak: extension metadata path traversal file existence oracleRed Hat Enterprise Linux 9
CVE-2026-96281Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimesRed Hat Enterprise Linux 9
CVE-2026-96280Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systemsRed Hat Enterprise Linux 7
CVE-2026-96279Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinksRed Hat Enterprise Linux 9
CVE-2026-96276Flatpak: flatpak: arbitrary write in host context via flatpak build-initRed Hat Enterprise Linux 9
CVE-2026-96275Flatpak: flatpak: arbitrary write access as root via extra-data extractionRed Hat Enterprise Linux 7
CVE-2026-95619Gcc: libstdc++ integer overflow in `new` operatorRed Hat OpenShift Container Platform 4
CVE-2026-95521Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpmRed Hat Hardened Images
CVE-2026-95520Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm…Red Hat Hardened Images
CVE-2026-95519Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)Red Hat Hardened Images
CVE-2026-95512Freetype: freetype: denial of service via repeated subroutine allocations in cid font loaderRed Hat Enterprise Linux 9
CVE-2026-95508Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtuRed Hat OpenShift Container Platform 4
CVE-2026-95503Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabledRed Hat Single Sign-On 7
CVE-2026-94640Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of serviceRed Hat OpenShift Container Platform 4
CVE-2026-94451Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via…Red Hat Exploit Intelligence
CVE-2026-94449Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of…Red Hat Fuse 7
CVE-2026-94416Aap-gateway: aap-gateway: authorization bypass via workload identity token forgeryRed Hat Ansible Automation Platform 2
CVE-2026-94368Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source headerRed Hat Openshift Data Foundation 4
CVE-2026-94218Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpointRed Hat Single Sign-On 7
CVE-2026-94217Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collisionRed Hat Single Sign-On 7
CVE-2026-94215Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership…Red Hat Single Sign-On 7
CVE-2026-94213Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identityRed Hat Single Sign-On 7
CVE-2026-94184Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)Red Hat Enterprise Linux 9
CVE-2026-94001Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permissionRed Hat Single Sign-On 7
CVE-2026-94000Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membershipRed Hat Single Sign-On 7
CVE-2026-93999Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clientsRed Hat Single Sign-On 7
CVE-2026-93834Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escapeRed Hat OpenStack Platform 13 (Queens)
CVE-2026-93685Multicluster-observability-addon: multicluster-observability-addon: possible unauthenticated debug/metrics endpoint via…Red Hat Advanced Cluster Management for Kubernetes 2
CVE-2026-93683Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctouRed Hat OpenStack Platform 13 (Queens)
CVE-2026-93676Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checksRed Hat Enterprise Linux 9
CVE-2026-93653Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count…Red Hat Hardened Images
CVE-2026-93579Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)Red Hat Single Sign-On 7
CVE-2026-93578Io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate…Red Hat build of Apache Camel for Spring Boot 4
CVE-2026-93576Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of…Red Hat Single Sign-On 7
CVE-2026-93575Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoderRed Hat Single Sign-On 7
CVE-2026-93574Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsingRed Hat Single Sign-On 7
CVE-2026-93573Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request…Red Hat Single Sign-On 7
CVE-2026-93572Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limitsRed Hat Single Sign-On 7
CVE-2026-93569Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the…Red Hat Single Sign-On 7
CVE-2026-93568Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are…Red Hat Single Sign-On 7
CVE-2026-93567Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with…Red Hat Single Sign-On 7
CVE-2026-93566Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size lineRed Hat Single Sign-On 7
CVE-2026-93565Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byteRed Hat Single Sign-On 7
CVE-2026-93564Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete…Red Hat Single Sign-On 7
CVE-2026-93563Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to…Red Hat Single Sign-On 7
CVE-2026-93562Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smugglingRed Hat Single Sign-On 7
CVE-2026-93561Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame…Red Hat Single Sign-On 7
CVE-2026-93560Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dosRed Hat Single Sign-On 7
CVE-2026-93558Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to…Red Hat Single Sign-On 7
CVE-2026-93494Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminatedRed Hat Single Sign-On 7
CVE-2026-93493Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate…Red Hat build of Apache Camel for Spring Boot 4
CVE-2026-93492Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table sizeRed Hat Single Sign-On 7
CVE-2026-93491Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queueRed Hat Single Sign-On 7
CVE-2026-93488Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streamsRed Hat Single Sign-On 7
CVE-2026-93433Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsingRed Hat Enterprise Linux 9
CVE-2026-93432Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkusRed Hat Fuse 7
CVE-2026-93017Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-readerRed Hat OpenShift Container Platform 4
CVE-2026-92982Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionRed Hat Service Telemetry Framework 1.5
CVE-2026-92925Redis: redis: out-of-bounds read via crafted cluster bus packetsRed Hat Hardened Images
CVE-2026-92904Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations checkRed Hat Satellite 6
CVE-2026-92894Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model override value destructionRed Hat Satellite 6
CVE-2026-92893Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parametersRed Hat Satellite 6
CVE-2026-92821Sssd: sssd: access control bypass via premature ldap access rule evaluationRed Hat OpenShift Container Platform 4
CVE-2026-92768Cockpit-machines: cockpit-machines: sensitive data exposure via command-line argumentsRed Hat Enterprise Linux 9
CVE-2026-92747Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process listRed Hat Enterprise Linux 9
CVE-2026-92745Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process argumentsRed Hat Enterprise Linux 9
CVE-2026-92615Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleedRed Hat Edge Manager 1
CVE-2026-92574Cri-o: cri-o checkpoint restore bypasses destination security contextRed Hat OpenShift Container Platform 4
CVE-2026-92430Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX WebhookUnknown Rede Itaú for WooCommerce — Payment PIX, Credit…
CVE-2026-92429Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit WebhookUnknown Rede Itaú for WooCommerce
CVE-2026-92428Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure WebhookUnknown Rede Itaú for WooCommerce
CVE-2026-92382Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds writeRed Hat Enterprise Linux 9
CVE-2026-92358Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linkingRed Hat Single Sign-On 7
CVE-2026-92091Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops arrayRed Hat OpenStack Platform 17.1
CVE-2026-91926Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair entries in ntlm challengeRed Hat Enterprise Linux 8
CVE-2026-91786Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer sizeRed Hat Enterprise Linux 9
CVE-2026-9165Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of serviceRed Hat Advanced Cluster Security 4
CVE-2026-9150Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksumsRed Hat Update Infrastructure 4 for Cloud Providers
CVE-2026-9149Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv fileRed Hat Update Infrastructure 4 for Cloud Providers
CVE-2026-91205Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink raceRed Hat Enterprise Linux 9
CVE-2026-91203Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race conditionRed Hat Enterprise Linux 9
CVE-2026-91202Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged pasteRed Hat Enterprise Linux 9
CVE-2026-91149Cockpit: cockpit: denial of service via unbounded connection thread spawningRed Hat OpenShift Dev Spaces
CVE-2026-91147Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slashRed Hat OpenShift Dev Spaces
CVE-2026-91142Cockpit: cockpit: unauthorized modification of login records via integer overflowRed Hat OpenShift Dev Spaces
CVE-2026-90996Sssd: sssd: denial of service in nss responder via crafted zero-length requestsRed Hat OpenShift Container Platform 4
CVE-2026-90995Sssd: sssd: local denial of service due to null pointer dereference in pam responderRed Hat OpenShift Container Platform 4
CVE-2026-90994Sssd: sssd: denial of service via malformed pam v1 requestsRed Hat OpenShift Container Platform 4
CVE-2026-90959Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and…Red Hat Update Infrastructure 5
CVE-2026-90954Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flushRed Hat Hardened Images
CVE-2026-90949Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatchRed Hat Enterprise Linux 9
CVE-2026-90948Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensionsRed Hat Enterprise Linux 8
CVE-2026-90947Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset fileRed Hat Enterprise Linux 8
CVE-2026-9088Keycloak: keycloak: information disclosure due to user profile permission bypassRed Hat build of Keycloak 26.6.3
CVE-2026-9087Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-loginRed Hat build of Keycloak 26.6.3
CVE-2026-9086Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypassRed Hat build of Keycloak 26.6.4
CVE-2026-9083Keycloak: keycloak: information disclosure through arbitrary filesystem path probingRed Hat build of Keycloak 26.6.4
CVE-2026-9073Foreman-mcp-server: mcp server: insecure sensitive http header sanitizationRed Hat Satellite 6.19
CVE-2026-9064389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap…Red Hat Enterprise Linux 6
CVE-2026-90463Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` /…Red Hat OpenShift Container Platform 4
CVE-2026-90462Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorizationRed Hat OpenShift Container Platform 4
CVE-2026-89329Device-mapper-multipath: local denial of service via blocking ipc send operationsRed Hat OpenShift Container Platform 4
CVE-2026-89298Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration…Red Hat Single Sign-On 7
CVE-2026-8922Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-servicesRed Hat build of Keycloak 26.6.3
CVE-2026-89098Nfs-utils: nfs-utils: denial of service via assertion failure in fsiddRed Hat OpenShift Container Platform 4
CVE-2026-89096Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statdRed Hat OpenShift Container Platform 4
CVE-2026-89091Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code…Red Hat Self-service automation portal 2
CVE-2026-89088Parted: parted: denial of service via heap buffer overflow during fat16 resizeRed Hat Enterprise Linux 9
CVE-2026-89085Parted: parted: heap-based buffer overflow via crafted fat32 filesystem imageRed Hat Enterprise Linux 9
CVE-2026-89060Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via…Red Hat Advanced Cluster Management for Kubernetes 2.17
CVE-2026-89059Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)Red Hat Single Sign-On 7
CVE-2026-89058Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard configRed Hat Single Sign-On 7
CVE-2026-88914Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parserRed Hat Enterprise Linux 9
CVE-2026-88859Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restrictionRed Hat Enterprise Linux 9
CVE-2026-88842Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruptionRed Hat Hardened Images
CVE-2026-88840Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthelloRed Hat Hardened Images
CVE-2026-88839Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpointRed Hat Hardened Images
CVE-2026-88838Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictionsRed Hat Hardened Images
CVE-2026-88837Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authenticationRed Hat Hardened Images
CVE-2026-88835Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb…Red Hat Hardened Images
CVE-2026-88834Busybox: busybox: httpd user existence oracle in non-default shadow-disabled buildsRed Hat Hardened Images
CVE-2026-88833Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of serviceRed Hat Hardened Images
CVE-2026-88832Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflowRed Hat Hardened Images
CVE-2026-88831Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengthsRed Hat Hardened Images
CVE-2026-88830Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflowRed Hat Hardened Images
CVE-2026-88829Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxyRed Hat Hardened Images
CVE-2026-88770Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accountsRed Hat Single Sign-On 7
CVE-2026-88763Skupper-router: skupper-router: unbounded recursion in amqp field parser leads to denial of serviceRed Hat Service Interconnect 2 for RHEL 9
CVE-2026-8830Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via…Red Hat build of Keycloak 26.6.3
CVE-2026-88265Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chownRed Hat OpenShift Container Platform 4
CVE-2026-88252Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustionRed Hat OpenShift Container Platform 4
CVE-2026-87876Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)Red Hat OpenShift Container Platform 4
CVE-2026-87875Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length boundRed Hat OpenShift Container Platform 4
CVE-2026-87874Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached…Red Hat OpenStack Platform 18.0
CVE-2026-87872Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hardcode validate_certs=false with…Red Hat OpenStack Platform 18.0
CVE-2026-87853Sssd: sssd: idp authentication prefix comparison allows cross-user impersonationRed Hat OpenShift Container Platform 4
CVE-2026-87766Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setupRed Hat Hardened Images
CVE-2026-87744Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped…Red Hat Exploit Intelligence
CVE-2026-87743Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityRed Hat OpenShift Dev Spaces
CVE-2026-87742Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message bufferingRed Hat Enterprise Linux AI (RHEL AI) 3
CVE-2026-87114Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudoRed Hat Lightspeed
CVE-2026-86856Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driverRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86849Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-cryptoRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86848Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-cryptoRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86847Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanupRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86846Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-cryptoRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86845Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanupRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86567Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmapRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86566Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)Red Hat OpenStack Platform 13 (Queens)
CVE-2026-86565Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds writeRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86564Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handlerRed Hat OpenShift Container Platform 4
CVE-2026-86563Dpdk: dpdk: double offset bug in vhost log mapping calculationRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86562Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)Red Hat OpenStack Platform 13 (Queens)
CVE-2026-86561Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setupRed Hat OpenStack Platform 13 (Queens)
CVE-2026-86476Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in…Red Hat Enterprise Linux 9
CVE-2026-86469Glib2: toctou symlink race in `g_file_create_replace_destination` fallback pathRed Hat OpenShift Container Platform 4
CVE-2026-86404Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis…Red Hat JBoss Enterprise Application Platform 8
CVE-2026-86345389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's…Red Hat Enterprise Linux 9
200 records, read from the index as it stood on 18 Oct 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.