Complete feed
Security advisories & CVEs
5200 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-4455] Heap buffer overflow in PDFium
Heap buffer overflow in PDFium. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-4461] Inappropriate implementation in V8
Inappropriate implementation in V8. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-23243] Linux kernel: Denial of service and memory corruption in RDMA umad
Linux kernel: Denial of service and memory corruption in RDMA umad. Red Hat rates this moderate (CVSS 7.3). Weakness: CWE-131. Affected package(s): kernel, kernel-rt. Resolved in Red Hat advisory RHSA-2026:13936 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 7.
Medium [CVE-2026-27980] Unbounded next/image disk cache growth can exhaust storage
Unbounded next/image disk cache growth can exhaust storage. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Affected package(s): com.github.streamshub-console. Resolved in Red Hat advisory RHSA-2026:13571 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-4366] Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak
Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-918. Affected package(s): rhbk/keycloak-operator-bundle:26.4.12, rhbk/keycloak-rhel9:26.4, rhbk/keycloak-rhel9-operator:26.4. Resolved in Red Hat advisory RHSA-2026:19596 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-46299] Processing maliciously crafted web content may disclose internal states of the app
Processing maliciously crafted web content may disclose internal states of the app. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-909. Affected package(s): webkit2gtk3, webkitgtk4. Resolved in Red Hat advisory RHSA-2026:19206 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7.
Medium [CVE-2026-20676] A website may be able to track users through Safari web extensions
A website may be able to track users through Safari web extensions. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-201. Affected package(s): webkit2gtk3, webkitgtk4. Resolved in Red Hat advisory RHSA-2026:19206 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7.
Medium [CVE-2026-4462] Out of bounds read in Blink
Out of bounds read in Blink. Red Hat rates this important (CVSS 6.5). Weakness: CWE-125. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-4460] Out of bounds read in Skia
Out of bounds read in Skia. Red Hat rates this important (CVSS 6.5). Weakness: CWE-125. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Low [CVE-2026-3479] Python pkgutil.get_data(): Path Traversal via improper resource argument validation
Python pkgutil.get_data(): Path Traversal via improper resource argument validation. Red Hat rates this low (CVSS 3.3). Weakness: CWE-22. Affected package(s): python3. Resolved in Red Hat advisory RHSA-2026:10118 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-27459] DTLS cookie callback buffer overflow
DTLS cookie callback buffer overflow. Red Hat rates this important (CVSS 8.1). Weakness: CWE-120. Affected package(s): pyopenssl-main, ansible-automation-platform, python3.12-pyOpenSSL, quay/quay-rhel8:1776752646, automation-controller, python-pyOpenSSL. Resolved in Red Hat advisory RHSA-2026:11916 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Satellite 6.16 for RHEL 8; and 16 more.
High [CVE-2026-32981] Ray Dashboard Path Traversal Leading to Local File Disclosure
Ray Dashboard Path Traversal Leading to Local File Disclosure. Red Hat rates this important (CVSS 7.5). Weakness: CWE-22. Affected package(s): rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1780078429, rhaiis/vllm-cuda-rhel9:1774351144, rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1778677734, rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1778677667, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1778677692, rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1780078413. Resolved in Red Hat advisory RHSA-2026:19712 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat AI Inference Server 3.2; Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat Enterprise Linux AI (RHEL AI) 3; and 1 more.
Medium [CVE-2026-27448] TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-636. Affected package(s): pyopenssl-main. Resolved in Red Hat advisory RHSA-2026:7224 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-4324] Denial of Service and potential information disclosure via SQL injection
Denial of Service and potential information disclosure via SQL injection. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-89. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, python-pulp-container, python-pulp-rpm, python-django. Resolved in Red Hat advisory RHSA-2026:5968 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9.
Critical [CVE-2026-28498] Authentication bypass via forged OpenID Connect ID Tokens
Authentication bypass via forged OpenID Connect ID Tokens. Red Hat rates this important (CVSS 9.1). Weakness: CWE-325. Affected package(s): ansible-automation-platform, quay/quay-rhel9:1775069491, quay/quay-rhel8:1775169155, quay/quay-rhel8:1775253092, quay/quay-rhel9:1775169226, quay/quay-rhel8:1775169219. Resolved in Red Hat advisory RHSA-2026:6309 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.6; Red Hat Quay 3.10; Red Hat Quay 3.12; Red Hat Quay 3.15; and 2 more.
Critical [CVE-2026-27962] Authentication bypass due to JWK Header Injection vulnerability
Authentication bypass due to JWK Header Injection vulnerability. Red Hat rates this important (CVSS 9.1). Weakness: CWE-347. Affected package(s): quay/quay-rhel9:1779204086, quay/quay-rhel8:1773971077, quay/quay-rhel8:1775512163, quay/quay-rhel8:1780891395. Resolved in Red Hat advisory RHSA-2026:7314 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Quay 3.10; Red Hat Quay 3.14; Red Hat Quay 3.15; Red Hat Quay 3.16; and 1 more.
High [CVE-2026-4177] YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter. Red Hat rates this important (CVSS 7.3). Weakness: CWE-120. Affected package(s): perl-YAML-Syck. Resolved in Red Hat advisory RHSA-2026:6470 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.
High [CVE-2026-32829] lz4_flex's decompression can leak information from uninitialized memory or reused output buffer
lz4_flex's decompression can leak information from uninitialized memory or reused output buffer. Red Hat rates this important (CVSS 7.5). Weakness: CWE-823. Affected package(s): openshift-logging/vector-rhel9:1777574710, openshift-logging/vector-rhel9:1776894389, rhoai/odh-llm-d-inference-scheduler-rhel9:1778263962, openshift-logging/vector-rhel9:1780052069. Resolved in Red Hat advisory RHSA-2026:19712 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Logging Subsystem for Red Hat OpenShift 6.2; Logging Subsystem for Red Hat OpenShift 6.4; Logging Subsystem for Red Hat OpenShift 6.5; Red Hat OpenShift AI 3.3; and 2 more.
High [CVE-2025-69196] Improper token issuance due to incorrect resource parameter handling
Improper token issuance due to incorrect resource parameter handling. Red Hat rates this important (CVSS 7.4). Weakness: CWE-1220. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Satellite 6.18.
Medium [CVE-2026-4224] Stack overflow parsing XML with deeply nested DTD content models
Stack overflow parsing XML with deeply nested DTD content models. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-805. Affected package(s): python3.12, python3, python3.14, rhui5/rhua-rhel9:1779798222, rhui5/installer-rhel9:1779798165. Resolved in Red Hat advisory RHSA-2026:19019 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8.