Complete feed
Security advisories & CVEs
5200 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Critical [CVE-2026-5859] Integer overflow in WebML
Integer overflow in WebML. Red Hat rates this important (CVSS 9.6). Weakness: CWE-190. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-28390] Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-476. Affected package(s): openssl-main, rhui5/installer-rhel9:1781525693, openssl, compat-openssl10, rhui5/cds-rhel9:1781525684, discovery/discovery-ui-rhel9:1782166952. Resolved in Red Hat advisory RHSA-2026:35869 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-34045] Denial of Service and Information Disclosure via unauthenticated HTTP server
Denial of Service and Information Disclosure via unauthenticated HTTP server. Red Hat rates this important (CVSS 8.2). Weakness: CWE-770. Affected package(s): rh-podman-desktop. Resolved in Red Hat advisory RHSA-2026:13867 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Build of Podman Desktop - Tech Preview.
High [CVE-2026-29181] github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers
github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected package(s): multicluster-engine/hypershift-addon-rhel9-operator:1780917881. Resolved in Red Hat advisory RHSA-2026:25271 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-39373] Memory exhaustion via crafted compressed JWE tokens
Memory exhaustion via crafted compressed JWE tokens. Red Hat rates this low (CVSS 7.5). Weakness: CWE-770. Affected package(s): python3.12-jwcrypto, python-jwcrypto. Resolved in Red Hat advisory RHSA-2026:13508 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1.
High [CVE-2026-39364] Information disclosure via query parameter manipulation on the development server
Information disclosure via query parameter manipulation on the development server. Red Hat rates this important (CVSS 7.5). Weakness: CWE-472. Affected package(s): ansible-automation-platform-tech-preview/mcp-server-rhel9:1779783248. Resolved in Red Hat advisory RHSA-2026:24866 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.6; Red Hat Build of Keycloak; Red Hat Build of Podman Desktop - Tech Preview; Red Hat OpenShift Container Platform 4.
High [CVE-2026-39363] Information disclosure via WebSocket connection bypasses access control
Information disclosure via WebSocket connection bypasses access control. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1220. Affected package(s): ansible-automation-platform-tech-preview/mcp-server-rhel9:1779783248, automation-platform-ui, automation-gateway. Resolved in Red Hat advisory RHSA-2026:24866 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Build of Keycloak; and 2 more.
High [CVE-2026-33816] Memory-safety vulnerability
Memory-safety vulnerability. Red Hat rates this important (CVSS 8.3). Weakness: CWE-787. Affected package(s): advanced-cluster-security/rhacs-scanner-v4-rhel8:1777986630, rhtas/updatetree-rhel9:1780053572, rhtas/createtree-rhel9:1780053572, advanced-cluster-security/rhacs-scanner-v4-rhel8:1777307791, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator:1779953535, go-fdo-server. Resolved in Red Hat advisory RHSA-2026:13907 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Enterprise Linux 10; RHEM 1.0 for RHEL 9; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 16 more.
High [CVE-2026-33815] Memory-safety vulnerability
Memory-safety vulnerability. Red Hat rates this important (CVSS 8.3). Weakness: CWE-787. Affected package(s): advanced-cluster-security/rhacs-scanner-v4-rhel8:1777986630, rhtas/updatetree-rhel9:1780053572, rhtas/createtree-rhel9:1780053572, advanced-cluster-security/rhacs-scanner-v4-rhel8:1777307791, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator:1779953535, rhtas/trillian-logserver-rhel9:1780053572. Resolved in Red Hat advisory RHSA-2026:24482 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Cryostat 4 on RHEL 9; RHEM 1.0 for RHEL 9; Red Hat Advanced Cluster Management for Kubernetes 2.15; Red Hat Advanced Cluster Security for Kubernetes 4.10; and 16 more.
High [CVE-2026-4740] Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation
Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation. Red Hat rates this important (CVSS 8.2). Weakness: CWE-295. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-20911] Arbitrary Code Execution via specially crafted file
Arbitrary Code Execution via specially crafted file. Red Hat rates this important (CVSS 7.5). Weakness: CWE-120. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.
High [CVE-2026-21413] Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading
Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787. Affected package(s): LibRaw. Resolved in Red Hat advisory RHSA-2026:11360 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; and 8 more.
High [CVE-2026-20889] Arbitrary code execution via specially crafted image file
Arbitrary code execution via specially crafted image file. Red Hat rates this important (CVSS 7.5). Weakness: CWE-120. Affected package(s): LibRaw. Resolved in Red Hat advisory RHSA-2026:13284 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; and 3 more.
High [CVE-2026-24660] Memory Corruption via Malicious File Processing
Memory Corruption via Malicious File Processing. Red Hat rates this important (CVSS 7.5). Weakness: CWE-120. Affected package(s): LibRaw. Resolved in Red Hat advisory RHSA-2026:13284 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; and 4 more.
High [CVE-2026-24450] Arbitrary code execution via a specially crafted malicious file
Arbitrary code execution via a specially crafted malicious file. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-190. Affected package(s): LibRaw. Resolved in Red Hat advisory RHSA-2026:11360 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9.
High [CVE-2026-5735] Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2
Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-5734] Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787. Affected package(s): thunderbird, firefox. Resolved in Red Hat advisory RHSA-2026:11805 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 10 more.
High [CVE-2026-5733] Incorrect boundary conditions in the Graphics: WebGPU component
Incorrect boundary conditions in the Graphics: WebGPU component. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-5732] Incorrect boundary conditions, integer overflow in the Graphics: Text component
Incorrect boundary conditions, integer overflow in the Graphics: Text component. Red Hat rates this important (CVSS 8.8). Weakness: CWE-190. Affected package(s): thunderbird, firefox. Resolved in Red Hat advisory RHSA-2026:11805 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
High [CVE-2026-5731] Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787. Affected package(s): thunderbird, firefox. Resolved in Red Hat advisory RHSA-2026:11805 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 10 more.