[ Vendor · 330 CVEs ]
Red Hat
CVEs affecting Red Hat published in the last 30 days, plus any Red Hat CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-115221 | 22 Oct 2026 | CVSS 5.4 | Red Hat Enterprise Linux 10A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to… | |
| CVE-2026-115424 | 22 Oct 2026 | CVSS 5.5 | Red Hat OpenShift Container Platform 4A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize… | |
| CVE-2026-115449 | 22 Oct 2026 | CVSS 3.5 | Red Hat Enterprise Linux 10A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host… | |
| CVE-2026-115207 | 22 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated… | |
| CVE-2026-111079 | 22 Oct 2026 | CVSS 7.4 | Red Hat Enterprise Linux 10A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim… | |
| CVE-2026-114406 | 21 Oct 2026 | CVSS 6.8 | Red Hat Hardened ImagesThe system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates… | |
| CVE-2026-85518 | 21 Oct 2026 | CVSS 6.1 | Red Hat Enterprise Linux 10A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path… | |
| CVE-2026-114438 | 21 Oct 2026 | CVSS 4.2 | Red Hat Build of KeycloakA flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered… | |
| CVE-2026-110744 | 21 Oct 2026 | CVSS 7.2 | Red Hat Multicluster Global HubA flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC)… | |
| CVE-2026-114370 | 21 Oct 2026 | CVSS 3.7 | Red Hat build of Apache Camel for Spring Boot 4A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the… | |
| CVE-2026-114236 | 21 Oct 2026 | CVSS 3.3 | Red Hat Confidential Compute Attestationstorage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded… | |
| CVE-2026-17557 | 21 Oct 2026 | CVSS 6.5 | Red Hat OpenShift AI (RHOAI)A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could… | |
| CVE-2026-92823 | 21 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that… | |
| CVE-2026-92824 | 21 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its… | |
| CVE-2026-92822 | 21 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping… | |
| CVE-2026-114038 | 21 Oct 2026 | CVSS 5.1 | Red Hat Enterprise Linux 10A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a… | |
| CVE-2026-105941 | 20 Oct 2026 | CVSS 8.1 | Red Hat streams for Apache Kafka 3The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling… | |
| CVE-2026-113495 | 20 Oct 2026 | CVSS 5.0 | Red Hat Enterprise Linux 10A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background… | |
| CVE-2026-113496 | 20 Oct 2026 | CVSS 5.0 | Red Hat Enterprise Linux 10A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a… | |
| CVE-2026-105311 | 20 Oct 2026 | CVSS 7.7 | Red Hat StreamsHub Console for Apache Kafka®The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set… | |
| CVE-2026-105312 | 20 Oct 2026 | CVSS 9.9 | Red Hat StreamsHub Console for Apache Kafka®A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The… | |
| CVE-2026-105949 | 20 Oct 2026 | CVSS 8.8 | Red Hat streams for Apache Kafka 2Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and… | |
| CVE-2026-112177 | 20 Oct 2026 | CVSS 7.3 | Red Hat Enterprise Linux 10A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from… | |
| CVE-2026-112257 | 19 Oct 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that… | |
| CVE-2026-112258 | 19 Oct 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a… | |
| CVE-2026-112261 | 19 Oct 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process… | |
| CVE-2026-112260 | 19 Oct 2026 | CVSS 7.1 | Red Hat Enterprise Linux 10A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap… | |
| CVE-2026-112259 | 19 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string… | |
| CVE-2026-112214 | 19 Oct 2026 | CVSS 6.5 | Red Hat Enterprise Linux 10A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to… | |
| CVE-2026-103314 | 19 Oct 2026 | CVSS 7.4 | Red Hat Advanced Cluster Security for Kubernetes 4.11A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML… | |
| CVE-2026-112210 | 19 Oct 2026 | CVSS 6.0 | Red Hat Enterprise Linux 10A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory… | |
| CVE-2026-16460 | 19 Oct 2026 | CVSS 7.4 | Red Hat Enterprise Linux 10A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the… | |
| CVE-2026-89085 | 16 Oct 2026 | CVSS 6.6 | Red Hat Enterprise Linux 10A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation… | |
| CVE-2026-89088 | 16 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing… | |
| CVE-2026-89096 | 16 Oct 2026 | CVSS 5.9 | Red Hat Enterprise Linux 10A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification… | |
| CVE-2026-111802 | 16 Oct 2026 | CVSS 6.6 | Red Hat Enterprise Linux 10A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without… | |
| CVE-2026-17591 | 16 Oct 2026 | CVSS 3.6 | Red Hat Hardened ImagesA flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free… | |
| CVE-2026-62438 | 16 Oct 2026 | CVSS 6.1 | Red Hat Enterprise Linux 10A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to… | |
| CVE-2026-62439 | 16 Oct 2026 | CVSS 7.0 | Red Hat Enterprise Linux 10A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a… | |
| CVE-2026-85231 | 16 Oct 2026 | CVSS 6.5 | Red Hat Enterprise Linux 10A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC… | |
| CVE-2026-85977 | 16 Oct 2026 | CVSS 5.3 | Red Hat Hardened ImagesA flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client… | |
| CVE-2026-89098 | 16 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to… | |
| CVE-2026-111581 | 16 Oct 2026 | CVSS 3.3 | Red Hat Enterprise Linux 10A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional… | |
| CVE-2026-111555 | 16 Oct 2026 | CVSS 6.0 | Red Hat Enterprise Linux 10A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to… | |
| CVE-2026-105958 | 16 Oct 2026 | CVSS 7.5 | Red Hat Enterprise Linux 6A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds… | |
| CVE-2026-105959 | 16 Oct 2026 | CVSS 7.5 | Red Hat Enterprise Linux 6A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback… | |
| CVE-2026-104715 | 16 Oct 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a… | |
| CVE-2026-84823 | 16 Oct 2026 | CVSS 7.1 | Red Hat Enterprise Linux 8A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path… | |
| CVE-2026-108334 | 15 Oct 2026 | CVSS 7.4 | Red Hat Connectivity Link 1.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether… | |
| CVE-2026-109131 | 15 Oct 2026 | CVSS 5.4 | Red Hat Ansible Automation Platform 2The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders… | |
| CVE-2026-85634 | 15 Oct 2026 | CVSS 8.8 | Red Hat Fuse 7A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to… | |
| CVE-2026-92982 | 15 Oct 2026 | CVSS 8.5 | Red Hat Ansible Automation Platform 2.6A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting… | |
| CVE-2026-86847 | 14 Oct 2026 | CVSS 6.5 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor… | |
| CVE-2026-86848 | 14 Oct 2026 | CVSS 8.8 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious… | |
| CVE-2026-86849 | 14 Oct 2026 | CVSS 6.5 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a… | |
| CVE-2026-86856 | 14 Oct 2026 | CVSS 6.5 | Red Hat Fast Datapath for RHEL 10A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are… | |
| CVE-2026-86566 | 14 Oct 2026 | CVSS 6.5 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a… | |
| CVE-2026-86567 | 14 Oct 2026 | CVSS 8.8 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. | |
| CVE-2026-86845 | 14 Oct 2026 | CVSS 6.5 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the… | |
| CVE-2026-86846 | 14 Oct 2026 | CVSS 6.5 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an… | |
| CVE-2026-110777 | 14 Oct 2026 | CVSS 5.7 | GNOME evolution-data-serverA flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local… | |
| CVE-2026-86562 | 14 Oct 2026 | CVSS 7.8 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content… | |
| CVE-2026-86563 | 14 Oct 2026 | CVSS 7.8 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. | |
| CVE-2026-86565 | 14 Oct 2026 | CVSS 8.2 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in… | |
| CVE-2026-100236 | 14 Oct 2026 | CVSS 8.6 | Red Hat Fast Datapath for RHEL 10A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the… | |
| CVE-2026-93683 | 14 Oct 2026 | CVSS 6.4 | Red Hat Fast Datapath for RHEL 10A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from… | |
| CVE-2026-86561 | 14 Oct 2026 | CVSS 6.5 | Red Hat Fast Datapath for RHEL 10A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host… | |
| CVE-2026-109968 | 14 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log… | |
| CVE-2026-88842 | 14 Oct 2026 | CVSS 3.3 | Red Hat Hardened ImagesA flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are… | |
| CVE-2026-104795 | 14 Oct 2026 | CVSS 8.8 | Red Hat OpenShift Container Platform 4.21The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When… | |
| CVE-2026-100229 | 14 Oct 2026 | CVSS 6.5 | Red Hat Enterprise Linux 10A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing… | |
| CVE-2026-88829 | 14 Oct 2026 | CVSS 7.2 | Red Hat Hardened ImagesA flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend… | |
| CVE-2026-90954 | 14 Oct 2026 | CVSS 7.8 | Red Hat Hardened ImagesA flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the… | |
| CVE-2026-86476 | 14 Oct 2026 | CVSS 8.4 | Red Hat Enterprise Linux 10A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata… | |
| CVE-2026-109971 | 14 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool… | |
| CVE-2026-109970 | 14 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting… | |
| CVE-2026-109969 | 14 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission… | |
| CVE-2026-100231 | 14 Oct 2026 | CVSS 6.1 | Red Hat Enterprise Linux 10A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters… | |
| CVE-2026-110036 | 13 Oct 2026 | CVSS 3.3 | Red Hat Enterprise Linux 10A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process… | |
| CVE-2026-88833 | 13 Oct 2026 | CVSS 6.5 | Red Hat Hardened ImagesA flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an… | |
| CVE-2026-88834 | 13 Oct 2026 | CVSS 3.7 | Red Hat Hardened ImagesA flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain… | |
| CVE-2026-88838 | 13 Oct 2026 | CVSS 5.5 | Red Hat Hardened ImagesA flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask… | |
| CVE-2026-105460 | 13 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link… | |
| CVE-2026-109833 | 13 Oct 2026 | CVSS 5.9 | Red Hat Enterprise Linux 10A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek… | |
| CVE-2026-109976 | 13 Oct 2026 | CVSS 4.7 | Red Hat Enterprise Linux 10A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket… | |
| CVE-2026-109832 | 13 Oct 2026 | CVSS 7.5 | Red Hat Enterprise Linux 10A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results… | |
| CVE-2026-109854 | 13 Oct 2026 | CVSS 2.5 | Red Hat Enterprise Linux 10A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read… | |
| CVE-2026-85471 | 12 Oct 2026 | CVSS 6.4 | Red Hat mirror registry for Red Hat OpenShiftA flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a… | |
| CVE-2026-87744 | 12 Oct 2026 | CVSS 9.1 | Red Hat build of Quarkus 3.27.6.redhatA flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated… | |
| CVE-2026-83535 | 12 Oct 2026 | CVSS 7.4 | Red Hat OpenStack Platform 18.0A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security… | |
| CVE-2026-83536 | 12 Oct 2026 | CVSS 5.3 | Red Hat OpenStack Platform 18.0A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as… | |
| CVE-2026-94451 | 12 Oct 2026 | CVSS 6.5 | Red Hat build of Quarkus 3.27.6.redhatQuarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not… | |
| CVE-2026-75888 | 12 Oct 2026 | CVSS 7.7 | Red Hat OpenShift Container Platform 4.19A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing… | |
| CVE-2026-109194 | 12 Oct 2026 | CVSS 6.4 | Red Hat Quay 3A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger… | |
| CVE-2026-109195 | 12 Oct 2026 | CVSS 3.1 | Red Hat Quay 3A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized… | |
| CVE-2026-108094 | 12 Oct 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious… | |
| CVE-2026-52903 | 12 Oct 2026 | CVSS 8.8 | ManageIQA deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to… | |
| CVE-2026-109082 | 12 Oct 2026 | CVSS 6.8 | Red Hat Build of KeycloakA flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This… | |
| CVE-2026-107193 | 12 Oct 2026 | CVSS 6.5 | Red Hat Satellite 6A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search… | |
| CVE-2026-107203 | 12 Oct 2026 | CVSS 5.4 | Red Hat Satellite 6An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API… |
Page 1 of 4