Complete feed
Security advisories & CVEs
2477 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-76172] URI parsing flaw enables server-side request forgery and redirects
URI parsing flaw enables server-side request forgery and redirects. Red Hat rates this important (CVSS 7.5). Weakness: CWE-76. Affected products named by the advisory: Migration Toolkit for Applications 8; Migration Toolkit for Containers; Multicluster Engine for Kubernetes; Network Observability Operator; and 29 more. Affected products named by the advisory: OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; Red Hat Advanced Cluster Management for Kubernetes 2; and 25 more.
High [CVE-2026-75975] Server-side request forgery via malformed IPv6 normalization
Server-side request forgery via malformed IPv6 normalization. Red Hat rates this important (CVSS 7.5). Weakness: CWE-918. Affected products named by the advisory: Migration Toolkit for Applications 8; Migration Toolkit for Containers; Multicluster Engine for Kubernetes; Network Observability Operator; and 29 more. Affected products named by the advisory: OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; Red Hat Advanced Cluster Management for Kubernetes 2; and 25 more.
High [CVE-2026-75899] Server-Side Request Forgery via repeated hostname percent-decoding
Server-Side Request Forgery via repeated hostname percent-decoding. Red Hat rates this important (CVSS 7.5). Weakness: CWE-140. Affected products named by the advisory: Migration Toolkit for Applications 8; Migration Toolkit for Containers; Multicluster Engine for Kubernetes; Network Observability Operator; and 29 more. Affected products named by the advisory: OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; Red Hat Advanced Cluster Management for Kubernetes 2; and 25 more.
High [CVE-2026-75931] Host confusion via skipped IDN canonicalization
Host confusion via skipped IDN canonicalization. Red Hat rates this important (CVSS 7.5). Weakness: CWE-444. Affected products named by the advisory: Migration Toolkit for Applications 8; Migration Toolkit for Containers; Multicluster Engine for Kubernetes; Network Observability Operator; and 29 more. Affected products named by the advisory: OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; Red Hat Advanced Cluster Management for Kubernetes 2; and 25 more.
High [CVE-2026-78161] Out-of-bounds write in LECP CBOR Recording
Out-of-bounds write in LECP CBOR Recording. Red Hat rates this important (CVSS 7.3). Weakness: CWE-787.
High [CVE-2026-52492] Arbitrary code execution via crafted TIFF image
Arbitrary code execution via crafted TIFF image. Red Hat rates this important (CVSS 7.3). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:53467 with package libtiff-main-4.7.2-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 5 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libtiff; Red Hat package: compat-libtiff3; and 1 more.
High [CVE-2026-52490] Arbitrary code execution via process_command_opts function
Arbitrary code execution via process_command_opts() function. Red Hat rates this important (CVSS 7.3). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:53467 with package libtiff-main-4.7.2-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 5 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libtiff; Red Hat package: compat-libtiff3; and 1 more.
Medium [CVE-2026-68516] Denial of service via crafted HTJ2K-compressed EXR with invalid image-offset
Denial of service via crafted HTJ2K-compressed EXR with invalid image-offset. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-787.
Medium [CVE-2026-17113] unvalidated image env var causes daemon crash
unvalidated image env var causes daemon crash. Red Hat rates this moderate (CVSS 6). Weakness: CWE-1287. Affected product named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2026-75509] Issuer-validation bypass via array-valued claims
Issuer-validation bypass via array-valued claims. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-480. Affected products named by the advisory: Lightspeed Core; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux command line assistant; Red Hat OpenShift Virtualization 4; Red Hat Satellite 6.
Medium [CVE-2026-78475] Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file. To exploit this vulnerability, an attacker needs to convince a user to process a specially crafted PIX image with GIMP, reducing the likelihood of exploitation. Due to this reason, this flaw has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: gimp.
Medium [CVE-2026-76845] Arbitrary File Overwrite via Symlink Following
Arbitrary File Overwrite via Symlink Following. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-59. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Build of Podman Desktop; Red Hat Developer Hub; Red Hat Enterprise Linux 8; and 7 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Fuse 7; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; and 3 more.
Medium [CVE-2026-78323] JSSTrustManager does not verify NSS trust flags on CA certificates
JSSTrustManager does not verify NSS trust flags on CA certificates. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-295. Affected products named by the advisory: Red Hat Certificate System 10; Red Hat Certificate System 11; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: jss.
Medium [CVE-2026-59295] Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures
Micrometer Instrumentation for Apache HttpAsyncClient: Denial of Service via asynchronous request failures. Red Hat rates this moderate. Weakness: CWE-772. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat build of Quarkus.
High [CVE-2026-62384] Information Disclosure via Symlink Sandbox Bypass
Information Disclosure via Symlink Sandbox Bypass. Red Hat rates this important (CVSS 7.5). Weakness: CWE-41. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; and 1 more. Affected products named by the advisory: Red Hat OpenShift AI (RHOAI).
High [CVE-2026-74730] Pin the 'struct nfs_server' during a FREE_STATEID call
Pin the 'struct nfs_server' during a FREE_STATEID call. Red Hat rates this moderate (CVSS 7). Weakness: CWE-911. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
High [CVE-2026-74677] fix carrier_work UAF on disconnect
fix carrier_work UAF on disconnect. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-74666] synchronize pressure clearing with ring reconfiguration
synchronize pressure clearing with ring reconfiguration. Red Hat rates this moderate (CVSS 7). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-74624] defer invalid log until after unlock
defer invalid log until after unlock. Red Hat rates this moderate (CVSS 7). Weakness: CWE-833. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-74700] Always acquire rtnl_lock when destroying locked classifiers
Always acquire rtnl_lock when destroying locked classifiers. Red Hat rates this moderate (CVSS 7). Weakness: CWE-763. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: kernel-rt.