Complete feed
Security advisories & CVEs
3463 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-76047] Arbitrary code execution via type confusion in V8
Arbitrary code execution via type confusion in V8. Red Hat rates this important (CVSS 8.3). Weakness: CWE-843.
High [CVE-2026-76045] Arbitrary code execution via use-after-free
Arbitrary code execution via use-after-free. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825.
High [CVE-2026-76043] Arbitrary code execution via incorrect calculation in HTML processing
Arbitrary code execution via incorrect calculation in HTML processing. Red Hat rates this important (CVSS 8.8). Weakness: CWE-190.
High [CVE-2026-76039] Information disclosure via incorrect reference resolution
Information disclosure via incorrect reference resolution. Red Hat rates this important (CVSS 7.1). Weakness: CWE-386.
High [CVE-2026-76040] Arbitrary code execution via use-after-free vulnerability
Arbitrary code execution via use-after-free vulnerability. Red Hat rates this important (CVSS 8.3). Weakness: CWE-825.
High [CVE-2026-76037] Arbitrary Code Execution via Link Following
Arbitrary Code Execution via Link Following. Red Hat rates this important (CVSS 8.2). Weakness: CWE-59.
High [CVE-2026-76033] Site isolation bypass due to inappropriate CORS implementation
Site isolation bypass due to inappropriate CORS implementation. Red Hat rates this important (CVSS 8.7). Weakness: CWE-653.
High [CVE-2026-76036] Dawn in Google Chrome: Arbitrary code execution via crafted HTML page
Dawn in Google Chrome: Arbitrary code execution via crafted HTML page. Red Hat rates this important (CVSS 8.3). Weakness: CWE-120.
High [CVE-2026-15571] Predictable account-linking hash enables account takeover via malicious OIDC client
Predictable account-linking hash enables account takeover via malicious OIDC client. Red Hat rates this important (CVSS 7.3). Weakness: CWE-341. Red Hat lists fixing advisory RHSA-2026:56524 with package rhbk/keycloak-rhel9:26.6-12, rhbk/keycloak-rhel9, keycloak-services, rhbk-openshift-rhel9/rhbk-openshift-rhel9. Affected product named by the advisory: Red Hat build of Keycloak 26.6.
High [CVE-2026-17106] The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process. Affected products named by the advisory: Docker Sandboxes; Docker Desktop; Docker Engine; Docker CLI; and 1 more. Affected products named by the advisory: Docker Compose.
High [CVE-2026-54552] Incomplete privilege drop allows child processes to retain privileged group access.
Incomplete privilege drop allows child processes to retain privileged group access. Red Hat rates this important (CVSS 7.9). Weakness: CWE-273. Affected product named by the advisory: Red Hat OpenShift Virtualization 4.
High [CVE-2026-66783] arbitrary image override enables privileged code execution on every node
arbitrary image override enables privileged code execution on every node. Red Hat rates this important (CVSS 8.2). Weakness: CWE-20. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
High [CVE-2026-66782] broker API bearer token stored cleartext in CR spec
broker API bearer token stored cleartext in CR spec. Red Hat rates this important (CVSS 7.8). Weakness: CWE-312. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
High [CVE-2026-75924] Hub addon-manager ClusterRole grants cluster-wide Secret read/write and CSR approval
Hub addon-manager ClusterRole grants cluster-wide Secret read/write and CSR approval. Red Hat rates this important (CVSS 8.7). Weakness: CWE-269. Affected product named by the advisory: Multicluster Engine for Kubernetes.
High [CVE-2026-71365] webhook status callback SSRF leaks the Git PAT
webhook status callback SSRF leaks the Git PAT. Red Hat rates this important (CVSS 7.7). Weakness: CWE-918. Red Hat lists fixing advisory RHSA-2026:59153 with package automation-controller-0:4.7.16-1.el9ap, ansible-automation-platform-26/controller-rhel9:1787244009, automation-controller-0:4.6.32-1.el8ap, ansible-automation-platform-27/controller-rhel9:1787220257. Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Ansible Automation Platform 2.7.
High [CVE-2026-66793] arbitrary container image override via ManagedClusterAddOn annotation enables RCE on spoke
arbitrary container image override via ManagedClusterAddOn annotation enables RCE on spoke. Red Hat rates this important (CVSS 8.8). Weakness: CWE-20. Red Hat lists fixing advisory RHSA-2026:60391 with package rhacm2/acm-governance-policy-addon-controller-rhel9:1787227696, rhacm2/acm-governance-policy-addon-controller-rhel9:1787080755, rhacm2/acm-governance-policy-addon-controller-rhel9:1787259078, rhacm2/acm-governance-policy-addon-controller-rhel9:1787080753. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
High [CVE-2026-63639] Remote code execution via use-after-free in stream deserialization
Remote code execution via use-after-free in stream deserialization. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: valkey.
High [CVE-2026-56684] Remote code execution via TLS pending-data processing use-after-free
Remote code execution via TLS pending-data processing use-after-free. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: valkey.
High [CVE-2026-74988] Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154
Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154. Red Hat rates this important (CVSS 7.5). Weakness: CWE-130.
High [CVE-2026-74947] Privilege escalation due to invalid pointer in the Graphics component
Privilege escalation due to invalid pointer in the Graphics component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825.