Complete feed
Security advisories & CVEs
5208 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-1207] SQL Injection via RasterField band index parameter
SQL Injection via RasterField band index parameter. Red Hat rates this important (CVSS 8.3). Weakness: CWE-89. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, discovery/discovery-server-rhel9:1770913597, satellite/iop-advisor-backend-rhel9:1773451075, ansible-automation-platform. Resolved in Red Hat advisory RHSA-2026:3958 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Satellite 6.16 for RHEL 8; and 5 more.
Medium [CVE-2025-61645] Cross-site scripting vulnerability allows information disclosure via improper input neutralization
Cross-site scripting vulnerability allows information disclosure via improper input neutralization. Red Hat rates this important (CVSS 4.6). Weakness: CWE-79. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Critical [CVE-2026-22778] Remote code execution via invalid image processing in the multimodal endpoint.
Remote code execution via invalid image processing in the multimodal endpoint.. Red Hat rates this critical (CVSS 9.8). Weakness: CWE-209. Affected package(s): rhaiis/vllm-rocm-rhel9:1782353093, rhaiis/vllm-spyre-rhel9:1782352919, rhaiis/vllm-cuda-rhel9:1782352847, rhoai/odh-vllm-gaudi-rhel9:1772093278, rhoai/odh-vllm-rocm-rhel9:1772093237, rhoai/odh-vllm-cpu-rhel9:1772093436. Resolved in Red Hat advisory RHSA-2026:19712 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat AI Inference Server 3.2; Red Hat AI Inference Server 3.3; Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3.
High [CVE-2025-6594] Cross-site Scripting vulnerability via improper input neutralization
Cross-site Scripting vulnerability via improper input neutralization. Red Hat rates this important (CVSS 8.1). Weakness: CWE-79. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-24040] Cross-User Data Leakage via race condition in addJS method
Cross-User Data Leakage via race condition in addJS method. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-820. Affected package(s): advanced-cluster-security/rhacs-main-rhel8:1773235860, advanced-cluster-security/rhacs-main-rhel8:1773235880. Resolved in Red Hat advisory RHSA-2026:4466 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-24737] Arbitrary code execution via unsanitized input in Acroform module
Arbitrary code execution via unsanitized input in Acroform module. Red Hat rates this important (CVSS 8.3). Weakness: CWE-917. Affected package(s): advanced-cluster-security/rhacs-main-rhel8:1773235860, advanced-cluster-security/rhacs-main-rhel8:1773235880. Resolved in Red Hat advisory RHSA-2026:4466 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Advanced Cluster Security for Kubernetes 4.8; Red Hat Advanced Cluster Security for Kubernetes 4.9; Red Hat Advanced Cluster Security 4.8; Red Hat Advanced Cluster Security 4.9.
High [CVE-2026-1761] Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response. Red Hat rates this important (CVSS 8.6). Weakness: CWE-121. Affected package(s): libsoup3, libsoup, spice-client-win, devspaces/pluginregistry-rhel9:1770918006, devspaces/openvsx-rhel9:1770851052, devspaces/udi-rhel9:1770913862. Resolved in Red Hat advisory RHSA-2026:2513 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 11 more.
Medium [CVE-2026-1757] Memory Leak Leading to Local Denial of Service in xmllint Interactive Shell
Memory Leak Leading to Local Denial of Service in xmllint Interactive Shell. Red Hat rates this moderate (CVSS 6.2). Weakness: CWE-401. Affected package(s): libxml2-main. Resolved in Red Hat advisory RHSA-2026:7519 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Low [CVE-2026-1703] Information disclosure via path traversal when installing crafted wheel archives
Information disclosure via path traversal when installing crafted wheel archives. Red Hat rates this low (CVSS 3.9). Weakness: CWE-22. Affected package(s): python-pip-main. Resolved in Red Hat advisory RHSA-2026:7610 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-25153] @backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
@backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks. Red Hat rates this important (CVSS 7.7). Weakness: CWE-94. Affected package(s): rhdh/rhdh-hub-rhel9:1774545605, rhdh/rhdh-hub-rhel9:1775140647. Resolved in Red Hat advisory RHSA-2026:6174 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Developer Hub 1.8; Red Hat Developer Hub 1.9.
High [CVE-2025-24293] Code injection in Active Storage when used in conjunction with the image_processing gem
Code injection in Active Storage when used in conjunction with the image_processing gem. Red Hat rates this important (CVSS 8.1). Weakness: CWE-88. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2024-4027] OutOfMemoryError in HttpServletRequestImpl.getParameterNames() can cause remote DoS attacks
OutOfMemoryError in HttpServletRequestImpl.getParameterNames() can cause remote DoS attacks. Red Hat rates this important (CVSS 7.5). Weakness: CWE-20. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat build of Apicurio Registry 2; Red Hat Fuse 7; Red Hat Integration Camel K 1; Red Hat Process Automation 7.
Medium [CVE-2026-25128] fast-xml-parser has RangeError DoS Numeric Entities Bug
fast-xml-parser has RangeError DoS Numeric Entities Bug. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-248. Affected package(s): odf4/ocs-metrics-exporter-rhel9:1781557202, odf4/mcg-core-rhel9:1781555645, odf4/odf-rhel9-operator:1781556958, advanced-cluster-security/rhacs-main-rhel8:1775594119, odf4/cephcsi-rhel9-operator:1781554936, odf4/ocs-client-console-rhel9:1781558423. Resolved in Red Hat advisory RHSA-2026:7110 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-25068] alsa-lib Topology Decoder Heap-based Buffer Overflow
alsa-lib Topology Decoder Heap-based Buffer Overflow. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-787. Affected package(s): alsa-lib-main. Resolved in Red Hat advisory RHSA-2026:7401 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
High [CVE-2025-61728] Excessive CPU consumption when building archive index in archive/zip
Excessive CPU consumption when building archive index in archive/zip. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-770. Affected package(s): openshift4/ose-csi-livenessprobe-rhel8:1776999947, openshift4/ose-csi-external-snapshotter-rhel8:1776999951, openshift4/ose-multus-route-override-cni-rhel8:1777001628, openshift4/ose-tests:1777002345, openshift4/ose-hypershift-rhel8:1777001784, openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator:1774582496. Resolved in Red Hat advisory RHSA-2026:3469 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
High [CVE-2025-61726] Memory exhaustion in query parameter parsing in net/url
Memory exhaustion in query parameter parsing in net/url. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected package(s): openshift4/ose-csi-livenessprobe-rhel8:1776999947, openshift4/ose-csi-external-snapshotter-rhel8:1776999951, openshift4/ose-multus-route-override-cni-rhel8:1777001628, openshift4/ose-tests:1777002345, skopeo, openshift4/ose-hypershift-rhel8:1777001784. Resolved in Red Hat advisory RHSA-2026:11749 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.6 for RHEL 10; Red Hat Enterprise Linux Server (v. 7 ELS); Red Hat Ansible Automation Platform 2.4 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 8; and 138 more.
High [CVE-2025-61731] Arbitrary file write via malicious pkg-config directive
Arbitrary file write via malicious pkg-config directive. Red Hat rates this important (CVSS 8.6). Weakness: CWE-88. Affected package(s): openshift4/ose-csi-livenessprobe-rhel8:1776999947, openshift4/ose-csi-external-snapshotter-rhel8:1776999951, openshift4/ose-prometheus-node-exporter-rhel9:1774294099, openshift4/oc-mirror-plugin-rhel9:1776961082, openshift4/ose-azure-file-csi-driver-operator-rhel9:1773363768, openshift4/ose-multus-route-override-cni-rhel8:1777001628. Resolved in Red Hat advisory RHSA-2026:5948 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 24 more.
High [CVE-2026-1530] Man-in-the-Middle vulnerability due to disabled certificate validation
Man-in-the-Middle vulnerability due to disabled certificate validation. Red Hat rates this important (CVSS 8.1). Weakness: CWE-295. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, python-pulp-container, python-pulp-rpm, python-django. Resolved in Red Hat advisory RHSA-2026:5971 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9.
High [CVE-2026-1531] Man-in-the-Middle due to insecure default SSL verification
Man-in-the-Middle due to insecure default SSL verification. Red Hat rates this important (CVSS 8.1). Weakness: CWE-295. Affected package(s): foreman, rubygem-katello, rubygem-foreman_kubevirt, rubygem-fog-kubevirt, python-pulp-container, python-pulp-rpm. Resolved in Red Hat advisory RHSA-2026:5968 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.18 for RHEL 9.
High [CVE-2026-24842] Arbitrary file creation via path traversal bypass in hardlink security check
Arbitrary file creation via path traversal bypass in hardlink security check. Red Hat rates this important (CVSS 8.2). Weakness: CWE-59. Affected package(s): network-observability/network-observability-console-plugin-rhel9:1771227650, network-observability/network-observability-console-plugin-compat-rhel9:1771227610, eap7-wildfly, rhtas/rekor-search-ui-rhel9:1773308315, linux-sgx, devspaces/dashboard-rhel9:1774476526. Resolved in Red Hat advisory RHSA-2026:18868 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7; Red Hat OpenShift Dev Spaces 3.27; and 7 more.