Complete feed
Security advisories & CVEs
2773 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-73422] Arbitrary code execution via unescaped View Transition animation properties
Arbitrary code execution via unescaped View Transition animation properties. Red Hat rates this important (CVSS 8.1). Weakness: CWE-79. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
High [CVE-2026-73415] Arbitrary code execution via malicious image in image viewer
Arbitrary code execution via malicious image in image viewer. Red Hat rates this important (CVSS 8). Weakness: CWE-911. Affected products named by the advisory: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-18724] Stack buffer overflow in idbm record parsing
Stack buffer overflow in idbm record parsing. Red Hat rates this moderate (CVSS 7.6). Weakness: CWE-121. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: iscsi-initiator-utils.
High [CVE-2026-73122] auto-generated Role grants every managed-cluster agent secrets:get,list,watch in Channel namespaces
auto-generated Role grants every managed-cluster agent secrets:get,list,watch in Channel namespaces. Red Hat rates this important (CVSS 7.7). Weakness: CWE-269. Red Hat lists fixing advisory RHSA-2026:60391 with package rhacm2/multicluster-operators-channel-rhel9:1787259310, rhacm2/multicluster-operators-channel-rhel9:1787242099, rhacm2/multicluster-operators-channel-rhel9:1787238600, rhacm2/multicluster-operators-channel-rhel9:1787260663. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
High [CVE-2026-66878] FetchChannelReferences honours Channel.spec.secretRef.namespace enabling cross-namespace Secret exfiltration
FetchChannelReferences honours Channel.spec.secretRef.namespace enabling cross-namespace Secret exfiltration. Red Hat rates this important (CVSS 7.7). Weakness: CWE-639. Red Hat lists fixing advisory RHSA-2026:60391 with package rhacm2/multicluster-operators-subscription-rhel9:1787242108, rhacm2/multicluster-operators-subscription-rhel9:1787263693, rhacm2/multicluster-operators-subscription-rhel9:1787242321, rhacm2/multicluster-operators-subscription-rhel9:1787240030. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
High [CVE-2026-68432] require CAP_NET_ADMIN in the device netns for changelink
require CAP_NET_ADMIN in the device netns for changelink. Red Hat rates this important (CVSS 7). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat package: kernel-rt.
High [CVE-2026-68442] don't propagate EXTENT_FLAG_LOGGING to split extent maps
don't propagate EXTENT_FLAG_LOGGING to split extent maps. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux for NVIDIA 26; Red Hat package: kernel.
High [CVE-2026-68448] check access to copy_file_range source with src mounter creds
check access to copy_file_range source with src mounter creds. Red Hat rates this moderate (CVSS 7). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux for NVIDIA 26; Red Hat package: kernel-rt.
Medium [CVE-2026-71846] ClusterRole grants cluster-wide secrets get/list/watch beyond least privilege
ClusterRole grants cluster-wide secrets get/list/watch beyond least privilege. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-250. Red Hat lists fixing advisory RHSA-2026:60391 with package rhacm2/insights-client-rhel9:1787227689, rhacm2/insights-client-rhel9:1787184541, rhacm2/insights-client-rhel9:1787688993, rhacm2/insights-client-rhel9:1787259125. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
Medium [CVE-2026-73499] Information disclosure via Watch API authorization bypass
Information disclosure via Watch API authorization bypass. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-551. Affected products named by the advisory: Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat OpenShift Container Platform 4; Red Hat OpenShift GitOps; and 3 more. Affected products named by the advisory: Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Medium [CVE-2026-18727] Integer underflow in iscsiuio DHCPv6 parsing
Integer underflow in iscsiuio DHCPv6 parsing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-191. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9.
Medium [CVE-2026-18726] Denial of service in iscsiuio Router Advertisement parsing
Denial of service in iscsiuio Router Advertisement parsing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-835. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9.
Medium [CVE-2026-73490] SVG `href` attribute bypasses local-reference restriction
SVG `href` attribute bypasses local-reference restriction. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-184.
Medium [CVE-2026-73427] Cross-site scripting via crafted JSON drag-and-drop
Cross-site scripting via crafted JSON drag-and-drop. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-79.
Medium [CVE-2026-73423] Cross-site Request Forgery (CSRF) due to origin check bypass in `astro/hono` pipeline
Cross-site Request Forgery (CSRF) due to origin check bypass in `astro/hono` pipeline. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-940. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-73433] unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write
unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write. Red Hat rates this moderate (CVSS 6.6). Weakness: CWE-191. Red Hat lists fixing advisory RHSA-2026:55436 with package gstreamer1-plugins-good-0:1.16.1-7.el8_10.3, gstreamer1-plugins-good-0:1.26.7-2.el10_2.5, gstreamer1-plugins-good-0:1.22.12-7.el9_8.4. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9.
Medium [CVE-2026-73434] out-of-bounds read in avidemux vprp video field descriptor parsing
out-of-bounds read in avidemux vprp video field descriptor parsing. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:55436 with package gstreamer1-plugins-good-0:1.16.1-7.el8_10.3, gstreamer1-plugins-good-0:1.26.7-2.el10_2.5, gstreamer1-plugins-good-0:1.22.12-7.el9_8.4. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9.
Medium [CVE-2026-19130] cross-namespace credential propagation via attacker-controlled copiedFrom labels bypasses authorization
cross-namespace credential propagation via attacker-controlled copiedFrom labels bypasses authorization. Red Hat rates this important (CVSS 5.8). Weakness: CWE-639. Red Hat lists fixing advisory RHSA-2026:59593 with package multicluster-engine/provider-credential-controller-rhel9:1787259099, multicluster-engine/provider-credential-controller-rhel9:1787176886, multicluster-engine/provider-credential-controller-rhel9:1787239595, multicluster-engine/provider-credential-controller-rhel9:1787176716. Affected product named by the advisory: Multicluster Engine for Kubernetes.
Medium [CVE-2026-73295] Material for MkDocs: DOM-based Cross-Site Scripting via crafted URL parameter
Material for MkDocs: DOM-based Cross-Site Scripting via crafted URL parameter. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79. Affected products named by the advisory: Red Hat Certification Program for Red Hat Enterprise Linux 9; Red Hat Developer Hub; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4; and 1 more. Affected products named by the advisory: Self-service automation portal 2.
Medium [CVE-2026-19548] Multiple Use-After-Free in add_archive_element via LTO plugin processing
Multiple Use-After-Free in add_archive_element via LTO plugin processing. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-416. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenShift Container Platform 4.