[ Vendor · 330 CVEs ]
Red Hat
CVEs affecting Red Hat published in the last 30 days, plus any Red Hat CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-102560 | 29 Sep 2026 | CVSS 9.8 | Red Hat Enterprise Linux 10A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations… | Fix |
| CVE-2026-102555 | 29 Sep 2026 | CVSS 8.2 | Red Hat Enterprise Linux 10A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when… | |
| CVE-2026-102556 | 29 Sep 2026 | CVSS 8.6 | Red Hat Enterprise Linux 10A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray… | |
| CVE-2026-102557 | 29 Sep 2026 | CVSS 8.6 | Red Hat Enterprise Linux 10A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size… | |
| CVE-2026-102623 | 29 Sep 2026 | CVSS 6.5 | Red Hat OpenShift Virtualization 4A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by… | |
| CVE-2026-95520 | 29 Sep 2026 | CVSS 7.1 | Red Hat Enterprise Linux 10A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is… | |
| CVE-2026-102473 | 29 Sep 2026 | CVSS 5.5 | Red Hat Enterprise Linux 6A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate… | |
| CVE-2026-102474 | 29 Sep 2026 | CVSS 4.0 | Red Hat Enterprise Linux 6A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five… | |
| CVE-2026-97024 | 29 Sep 2026 | CVSS 7.1 | Red Hat Enterprise Linux 10A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain… | |
| CVE-2026-97029 | 29 Sep 2026 | CVSS 5.7 | Red Hat Enterprise Linux 10Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes… | |
| CVE-2026-97027 | 28 Sep 2026 | CVSS 3.6 | Red Hat Enterprise Linux 10Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service… | |
| CVE-2026-97025 | 28 Sep 2026 | CVSS 3.2 | Red Hat Enterprise Linux 10Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other… | |
| CVE-2026-97026 | 28 Sep 2026 | CVSS 3.9 | Red Hat Enterprise Linux 10Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems with a… | |
| CVE-2026-97023 | 28 Sep 2026 | CVSS 7.1 | Red Hat Enterprise Linux 10A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause… | |
| CVE-2026-102010 | 28 Sep 2026 | CVSS 7.0 | Red Hat Hardened ImagesA flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates… | |
| CVE-2026-96740 | 28 Sep 2026 | CVSS 6.5 | Red Hat StreamsHub Console for Apache Kafka®A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into… | |
| CVE-2026-87114 | 28 Sep 2026 | CVSS 7.1 | Red Hat OpenShift Container Platform 4.19A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's… | |
| CVE-2026-101333 | 28 Sep 2026 | CVSS 3.7 | Red Hat Build of KeycloakA flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management. The issue… | |
| CVE-2026-86330 | 28 Sep 2026 | CVSS 7.2 | Red Hat Openshift Data Foundation 4An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for… | |
| CVE-2026-101292 | 28 Sep 2026 | CVSS 8.2 | Red Hat JBoss Enterprise Application Platform 7.4.25Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method… | |
| CVE-2026-96284 | 27 Sep 2026 | CVSS 2.5 | Red Hat Enterprise Linux 10A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code… | |
| CVE-2026-96282 | 27 Sep 2026 | CVSS 3.1 | Red Hat Enterprise Linux 10A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory… | |
| CVE-2026-96283 | 27 Sep 2026 | CVSS 3.3 | Red Hat Enterprise Linux 10By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal… | |
| CVE-2026-96280 | 27 Sep 2026 | CVSS 7.5 | Red Hat Enterprise Linux 10The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems)… | |
| CVE-2026-96281 | 27 Sep 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's… | |
| CVE-2026-96279 | 27 Sep 2026 | CVSS 6.5 | Red Hat Enterprise Linux 10A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from… | |
| CVE-2026-93834 | 25 Sep 2026 | CVSS 8.8 | Red Hat Enterprise Linux 10A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing… | |
| CVE-2026-96448 | 25 Sep 2026 | CVSS 6.6 | Red Hat Build of KeycloakA flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs… | |
| CVE-2026-97846 | 25 Sep 2026 | CVSS 6.8 | Red Hat Build of KeycloakKeycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it… | |
| CVE-2026-90959 | 24 Sep 2026 | CVSS 8.1 | Red Hat Ansible Automation Platform 2.6 for RHEL 9A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository… | |
| CVE-2026-95519 | 24 Sep 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar… | |
| CVE-2026-95521 | 24 Sep 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct… | |
| CVE-2026-94416 | 24 Sep 2026 | CVSS 6.8 | Red Hat Ansible Automation Platform 2.6 for RHEL 9An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a… | |
| CVE-2026-97311 | 24 Sep 2026 | CVSS 4.3 | Red Hat Build of KeycloakA flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with… | |
| CVE-2026-97185 | 24 Sep 2026 | CVSS 7.8 | Red Hat Enterprise Linux 8A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices… | |
| CVE-2026-97176 | 24 Sep 2026 | CVSS 4.2 | Red Hat Build of KeycloakA flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when… | |
| CVE-2026-97177 | 24 Sep 2026 | CVSS 6.6 | Red Hat Build of KeycloakA flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to… | |
| CVE-2026-75887 | 23 Sep 2026 | CVSS 7.5 | Red Hat OpenShift Container Platform 4.12A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns`… | |
| CVE-2026-75886 | 23 Sep 2026 | CVSS 7.2 | Red Hat OpenShift Container Platform 4.17A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper… | |
| CVE-2026-96889 | 23 Sep 2026 | CVSS 7.8 | Librsvg: Use-after-free when XML includes have duplicated entitiesA flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a… | Fix |
| CVE-2026-84724 | 23 Sep 2026 | CVSS 6.6 | Red Hat Ansible Automation Platform 2.5 for RHEL 8An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch… | |
| CVE-2026-85475 | 23 Sep 2026 | CVSS 7.2 | Red Hat Ansible Automation Platform 2.7A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating… | |
| CVE-2026-84714 | 23 Sep 2026 | CVSS 7.1 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject… | |
| CVE-2026-84716 | 23 Sep 2026 | CVSS 6.6 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install… | |
| CVE-2026-84717 | 23 Sep 2026 | CVSS 5.3 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC… | |
| CVE-2026-84718 | 23 Sep 2026 | CVSS 4.3 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the… | |
| CVE-2026-84719 | 23 Sep 2026 | CVSS 9.9 | Red Hat Ansible Automation Platform 2.4 for RHEL 8A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer… | |
| CVE-2026-84720 | 23 Sep 2026 | CVSS 6.5 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the… | |
| CVE-2026-84721 | 23 Sep 2026 | CVSS 6.4 | Red Hat Ansible Automation Platform 2.7A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend… | |
| CVE-2026-84683 | 23 Sep 2026 | CVSS 8.7 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory… | |
| CVE-2026-84691 | 23 Sep 2026 | CVSS 8.7 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors… | |
| CVE-2026-84706 | 23 Sep 2026 | CVSS 7.6 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable… | |
| CVE-2026-84712 | 23 Sep 2026 | CVSS 5.3 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes… | |
| CVE-2026-84713 | 23 Sep 2026 | CVSS 6.5 | Red Hat Ansible Automation Platform 2.7A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API… | |
| CVE-2026-75884 | 23 Sep 2026 | CVSS 9.1 | Red Hat Ansible Automation Platform 2.4 for RHEL 8A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken… | |
| CVE-2026-96541 | 23 Sep 2026 | CVSS 7.5 | Red Hat Enterprise Linux 10A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the… | |
| CVE-2026-96545 | 23 Sep 2026 | CVSS 4.4 | Red Hat Enterprise Linux 10An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA… | |
| CVE-2026-96546 | 23 Sep 2026 | CVSS 2.5 | Red Hat Enterprise Linux 10A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds… | |
| CVE-2026-84486 | 23 Sep 2026 | CVSS 8.2 | Red Hat Ansible Automation Platform 2.6 for RHEL 9A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and… | |
| CVE-2026-84499 | 23 Sep 2026 | CVSS 7.7 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored… | |
| CVE-2026-84502 | 23 Sep 2026 | CVSS 9.9 | Red Hat Ansible Automation Platform 2.4 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that… | |
| CVE-2026-84474 | 23 Sep 2026 | CVSS 9.9 | Red Hat Ansible Automation Platform 2.4 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to… | |
| CVE-2026-76648 | 23 Sep 2026 | CVSS 8.5 | Red Hat Ansible Automation Platform 2.7CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The… | |
| CVE-2026-71462 | 23 Sep 2026 | CVSS 4.1 | Red Hat Ansible Automation Platform 2.5 for RHEL 8StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary… | |
| CVE-2026-71463 | 23 Sep 2026 | CVSS 2.7 | Red Hat Ansible Automation Platform 2.5 for RHEL 8Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) and {% if job.id > 100 %}… | |
| CVE-2026-71464 | 23 Sep 2026 | CVSS 3.1 | Red Hat Ansible Automation Platform 2.5 for RHEL 8LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers… | |
| CVE-2026-71465 | 23 Sep 2026 | CVSS 3.1 | Red Hat Ansible Automation Platform 2.5 for RHEL 8RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit… | |
| CVE-2026-71459 | 23 Sep 2026 | CVSS 5.0 | Red Hat Ansible Automation Platform 2.5 for RHEL 8JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any… | |
| CVE-2026-71460 | 23 Sep 2026 | CVSS 4.3 | Red Hat Ansible Automation Platform 2.5 for RHEL 8/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts)… | |
| CVE-2026-71461 | 23 Sep 2026 | CVSS 4.3 | Red Hat Ansible Automation Platform 2.7HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking… | |
| CVE-2026-71458 | 23 Sep 2026 | CVSS 5.0 | Red Hat Ansible Automation Platform 2.5 for RHEL 8URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses… | |
| CVE-2026-88831 | 23 Sep 2026 | CVSS 5.3 | Red Hat Hardened ImagesBusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. | |
| CVE-2026-88835 | 23 Sep 2026 | CVSS 6.1 | Red Hat Hardened ImagesBusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. | |
| CVE-2026-88837 | 23 Sep 2026 | CVSS 6.5 | Red Hat Hardened ImagesBusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. | |
| CVE-2026-88839 | 23 Sep 2026 | CVSS 6.7 | Red Hat Hardened ImagesBusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. | |
| CVE-2026-88840 | 23 Sep 2026 | CVSS 5.3 | Red Hat Hardened ImagesBusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. | |
| CVE-2026-88830 | 23 Sep 2026 | CVSS 7.5 | Red Hat Hardened ImagesA unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted… | |
| CVE-2026-88832 | 23 Sep 2026 | CVSS 7.3 | Red Hat Hardened ImagesBusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted… | |
| CVE-2026-96275 | 23 Sep 2026 | CVSS 8.8 | Red Hat Enterprise Linux 10A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via… | |
| CVE-2026-96276 | 23 Sep 2026 | CVSS 6.5 | Red Hat Enterprise Linux 10If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk… | |
| CVE-2026-96512 | 23 Sep 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z'… | |
| CVE-2026-96445 | 23 Sep 2026 | CVSS 6.8 | Red Hat Build of KeycloakA flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system… | |
| CVE-2026-96446 | 23 Sep 2026 | CVSS 4.2 | Red Hat Build of KeycloakA flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none… | |
| CVE-2026-96442 | 23 Sep 2026 | CVSS 7.8 | GNU EmacsA code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute… | |
| CVE-2026-94640 | 22 Sep 2026 | CVSS 7.5 | Red Hat Enterprise Linux 10A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large… | |
| CVE-2026-80110 | 21 Sep 2026 | CVSS 8.1 | Red Hat Enterprise Linux 10A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using… | |
| CVE-2026-92768 | 18 Sep 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including… | |
| CVE-2026-92747 | 18 Sep 2026 | CVSS 5.0 | Red Hat Enterprise Linux 10A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive… | |
| CVE-2026-92745 | 18 Sep 2026 | CVSS 5.0 | Red Hat Enterprise Linux 10A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive… | |
| CVE-2026-89058 | 18 Sep 2026 | CVSS 7.4 | Red HatA flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the… | |
| CVE-2026-89059 | 18 Sep 2026 | CVSS 7.5 | Red HatA flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared… | |
| CVE-2026-86320 | 17 Sep 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a… | |
| CVE-2026-42784 | 16 Sep 2026 | CVSS 7.4 | Red Hat Ansible Automation Platform 2.6 for RHEL 9A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading… | |
| CVE-2026-85234 | 15 Sep 2026 | CVSS 7.5 | Red Hat Enterprise Linux 10A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error… | |
| CVE-2026-85013 | 15 Sep 2026 | CVSS 7.3 | Red Hat Enterprise Linux 10A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location… | |
| CVE-2026-88924 | 10 Sep 2026 | CVSS 7.0 | GNOME gvfsA flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by… | |
| CVE-2026-88763 | 10 Sep 2026 | CVSS 5.9 | Red Hat Service Interconnect 2 for RHEL 8A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed… | |
| CVE-2026-18147 | 9 Sep 2026 | CVSS 8.1 | Red Hat Enterprise Linux 10A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web… | |
| CVE-2026-87853 | 9 Sep 2026 | CVSS 7.5 | Red Hat Enterprise Linux 10A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp()… | |
| CVE-2026-87766 | 9 Sep 2026 | CVSS 8.8 | Red Hat Enterprise Linux 10A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via… |
Page 3 of 4