Complete feed
Action required
Critical/high still unreviewed, or CISA KEV listed
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-74934] Site isolation issue in the Graphics: CanvasWebGL component
Site isolation issue in the Graphics: CanvasWebGL component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-653. Red Hat lists fixing advisory RHSA-2026:58897 with package firefox-0:140.14.0-1.el10_2, firefox-0:140.14.0-1.el8_10, firefox-0:140.14.0-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-74936] Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:58897 with package firefox-0:140.14.0-1.el10_2, firefox-0:140.14.0-1.el8_10, firefox-0:140.14.0-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-74935] Privilege escalation in the DOM: Networking component
Privilege escalation in the DOM: Networking component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-266. Red Hat lists fixing advisory RHSA-2026:58897 with package firefox-0:140.14.0-1.el10_2, firefox-0:140.14.0-1.el8_10, firefox-0:140.14.0-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-75838] Cross-Site Scripting via IN_PLACE sanitization
Cross-Site Scripting via IN_PLACE sanitization. Red Hat rates this important (CVSS 7.3). Weakness: CWE-79. Affected products named by the advisory: Migration Toolkit for Virtualization; Multicluster Engine for Kubernetes; Node HealthCheck Operator; OpenShift Service Mesh 3; and 15 more. Affected products named by the advisory: Red Hat 3scale API Management Platform 2; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Advanced Cluster Security 4; Red Hat Ansible Automation Platform 2; and 11 more.
High [CVE-2026-70906] Improve font loading (2026-08 Security Update)
Improve font loading (2026-08 Security Update). Red Hat rates this moderate (CVSS 7.5). Red Hat lists fixing advisory RHSA-2026:55799 with package java-25-openjdk-portable, java-25-openjdk-1:25.0.4.1.1-1.1.el9, java-25-openjdk-windows, java-25-openjdk-main-25.0.4.1.1-1.1.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10.
Critical [CVE-2026-66795] CSR auto-approver does not validate certificate Subject, signerName, or requester identity
CSR auto-approver does not validate certificate Subject, signerName, or requester identity. Red Hat rates this important (CVSS 9.1). Weakness: CWE-295. Red Hat lists fixing advisory RHSA-2026:59593 with package multicluster-engine/managedcluster-import-controller-rhel9:1787078307, multicluster-engine/managedcluster-import-controller-rhel9:1786577915, multicluster-engine/managedcluster-import-controller-rhel9:1787260779, multicluster-engine/managedcluster-import-controller-rhel9:1787259044. Affected product named by the advisory: Multicluster Engine for Kubernetes.
Critical [CVE-2026-71472] Shell-command and SQL injection in postgresql-start.sh via CR-supplied WORK_MEM
Shell-command and SQL injection in postgresql-start.sh via CR-supplied WORK_MEM. Red Hat rates this important (CVSS 9.1). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:60391 with package rhacm2/acm-search-v2-rhel9:1787682033, rhacm2/acm-search-v2-rhel9:1787681674, rhacm2/acm-search-v2-rhel9:1787681686, rhacm2/acm-search-v2-rhel9:1787682112. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
Critical [CVE-2026-66792] IsClusterAdmin trusts user-settable annotations on managed clusters
IsClusterAdmin() trusts user-settable annotations on managed clusters. Red Hat rates this important (CVSS 9.9). Weakness: CWE-863. Red Hat lists fixing advisory RHSA-2026:60391 with package rhacm2/multicluster-operators-application-rhel9:1787259284, rhacm2/multicluster-operators-application-rhel9:1787238598, rhacm2/multicluster-operators-subscription-rhel9:1787242108, rhacm2/multicluster-operators-application-rhel9:1787262214. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 3 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17; Red Hat OpenShift Container Platform 4.
High [CVE-2026-43794] Processing maliciously crafted web content may lead to memory corruption
Processing maliciously crafted web content may lead to memory corruption. Red Hat rates this important (CVSS 8.8). Weakness: CWE-120. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat package: webkitgtk.
High [CVE-2026-64782] Processing maliciously crafted web content may lead to an unexpected Safari crash
Processing maliciously crafted web content may lead to an unexpected Safari crash. Red Hat rates this important (CVSS 8.8). Weakness: CWE-667. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 3 more. Affected products named by the advisory: Red Hat package: webkitgtk3; Red Hat package: webkitgtk4; Red Hat package: webkit2gtk3.
High [CVE-2026-65341] Processing maliciously crafted web content may lead to memory corruption
Processing maliciously crafted web content may lead to memory corruption. Red Hat rates this important (CVSS 8.8). Weakness: CWE-120. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 3 more. Affected products named by the advisory: Red Hat package: webkitgtk3; Red Hat package: webkitgtk4; Red Hat package: webkit2gtk3.
High [CVE-2026-64781] Processing maliciously crafted web content may lead to an unexpected Safari crash
Processing maliciously crafted web content may lead to an unexpected Safari crash. Red Hat rates this important (CVSS 8.8). Weakness: CWE-20. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat package: webkitgtk.
High [CVE-2026-64715] Processing maliciously crafted web content may lead to an unexpected process crash
Processing maliciously crafted web content may lead to an unexpected process crash. Red Hat rates this important (CVSS 8.8). Weakness: CWE-416. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 3 more. Affected products named by the advisory: Red Hat package: webkitgtk3; Red Hat package: webkitgtk4; Red Hat package: webkit2gtk3.
High [CVE-2026-64780] Processing maliciously crafted web content may lead to an unexpected Safari crash
Processing maliciously crafted web content may lead to an unexpected Safari crash. Red Hat rates this important (CVSS 8.8). Weakness: CWE-20. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 3 more. Affected products named by the advisory: Red Hat package: webkitgtk3; Red Hat package: webkitgtk4; Red Hat package: webkit2gtk3.
High [CVE-2026-64849] Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding). Red Hat rates this important (CVSS 8.5). Weakness: CWE-918. Red Hat lists fixing advisory RHSA-2026:60520 with package rhoai/odh-mlflow-rhel9:1787226790. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
High [CVE-2026-34398] Arbitrary Code Execution via malicious BIM project template
Arbitrary Code Execution via malicious BIM project template. Red Hat rates this important (CVSS 7.8). Weakness: CWE-94.
High [CVE-2026-34789] Arbitrary code execution via crafted document restoration
Arbitrary code execution via crafted document restoration. Red Hat rates this important (CVSS 7.8). Weakness: CWE-502.
High [CVE-2026-70495] cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters
cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters. Red Hat rates this important (CVSS 8.8). Weakness: CWE-269. Red Hat lists fixing advisory RHSA-2026:60391 with package rhacm2/acm-search-v2-rhel9:1787682033, rhacm2/acm-search-v2-rhel9:1787681674, rhacm2/acm-search-v2-rhel9:1787681686, rhacm2/acm-search-v2-rhel9:1787682112. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
High [CVE-2026-46345] Arbitrary file write via path traversal vulnerability
Arbitrary file write via path traversal vulnerability. Red Hat rates this important (CVSS 8.4). Weakness: CWE-22. Affected product named by the advisory: File Integrity Operator.
High [CVE-2026-54284] Denial of Service via quadratic CPU consumption in SQL parsing
Denial of Service via quadratic CPU consumption in SQL parsing. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1333. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Discovery 2; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; and 7 more. Affected products named by the advisory: Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0; Red Hat Satellite 6; and 3 more.