Complete feed
Security advisories & CVEs
5233 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-24401] Denial of Service via recursive CNAME record in mDNS response
Denial of Service via recursive CNAME record in mDNS response. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-674. Affected package(s): avahi-main. Resolved in Red Hat advisory RHSA-2026:11316 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-1299] email header injection due to unquoted newlines
email header injection due to unquoted newlines. Red Hat rates this moderate (CVSS 7.1). Weakness: CWE-93. Affected package(s): discovery/discovery-server-rhel9:1775668717, python3, python3.11, python3.12, rhui5/rhua-rhel9:1773670137, rhaiis/vllm-rocm-rhel9:1775680262. Resolved in Red Hat advisory RHSA-2026:5606 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 7.
High [CVE-2026-0994] Denial of Service due to recursion depth bypass
Denial of Service due to recursion depth bypass. Red Hat rates this important (CVSS 7.5). Weakness: CWE-674. Affected package(s): protobuf, python3.12-protobuf, rhaiis/vllm-spyre-rhel9:1778244546, rhaiis/model-opt-cuda-rhel9:1775749857, rhaiis/vllm-rocm-rhel9:1775680262, rhaiis/vllm-cuda-rhel9:1775680192. Resolved in Red Hat advisory RHSA-2026:3958 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Enterprise Linux 10.0 Extended Update Support; and 6 more.
High [CVE-2026-0775] npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. Red Hat rates this important (CVSS 7). Weakness: CWE-732. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2025-15059] heap-based buffer overflow via specially crafted PSP file
heap-based buffer overflow via specially crafted PSP file. Red Hat rates this important (CVSS 7.8). Weakness: CWE-122. Affected package(s): gimp. Resolved in Red Hat advisory RHSA-2026:2953 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 9.6 Extended Update Support; and 1 more.
High [CVE-2026-22984] prevent potential out-of-bounds reads in handle_auth_done()
prevent potential out-of-bounds reads in handle_auth_done(). Red Hat rates this moderate (CVSS 7.1). Affected package(s): kernel-rt, kernel. Resolved in Red Hat advisory RHSA-2026:25120 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-22990] replace overzealous BUG_ON in osdmap_apply_incremental()
replace overzealous BUG_ON in osdmap_apply_incremental(). Red Hat rates this moderate (CVSS 7.1). Weakness: CWE-617. Affected package(s): kernel-rt, kernel. Resolved in Red Hat advisory RHSA-2026:25120 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2025-71151] Fix memory and information leak in smb3_reconfigure()
Fix memory and information leak in smb3_reconfigure(). Red Hat rates this low (CVSS 5.5). Weakness: CWE-772. Affected package(s): kernel. Resolved in Red Hat advisory RHSA-2025:6966 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1.
Critical [CVE-2026-20912] Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure
Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure. Red Hat rates this critical (CVSS 9.1). Weakness: CWE-283. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Critical [CVE-2026-20897] Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)
Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR). Red Hat rates this critical (CVSS 9.1). Weakness: CWE-639. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Critical [CVE-2026-20750] Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)
Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR). Red Hat rates this critical (CVSS 9.1). Weakness: CWE-284. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-20736] Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check
Cross-Repository Unauthorized Deletion via Missing Repo Ownership Check. Red Hat rates this important (CVSS 7.5). Weakness: CWE-284. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-1260] Invalid memory access leading to potential arbitrary code execution via a crafted model file.
Invalid memory access leading to potential arbitrary code execution via a crafted model file.. Red Hat rates this important (CVSS 7.8). Weakness: CWE-119. Affected package(s): rhoai/odh-openvino-model-server-rhel9:1772093351, rhoai/odh-training-cuda124-torch25-py311-rhel9:1772093260, rhoai/odh-training-cuda121-torch24-py311-rhel9:1772093252, rhoai/odh-openvino-model-server-rhel9:1771608633, rhoai/odh-training-rocm62-torch25-py311-rhel9:1772093324, rhoai/odh-training-rocm62-torch24-py311-rhel9:1772093338. Resolved in Red Hat advisory RHSA-2026:3713 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat AI Inference Server.
High [CVE-2026-24049] Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking
Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking. Red Hat rates this important (CVSS 7.1). Weakness: CWE-22. Affected package(s): devspaces/udi-rhel9:1774451954, rhtas/segment-reporting-rhel9:1770108732, ansible-automation-platform, rhoai/odh-training-rocm62-torch24-py311-rhel9:1772093338, quay/quay-rhel9:1770836901, rhoai/odh-training-cuda124-torch25-py311-rhel9:1772093260. Resolved in Red Hat advisory RHSA-2026:2139 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Discovery 2 for RHEL 10; Discovery 2 for RHEL 8; Discovery 2 for RHEL 9; Red Hat Ansible Automation Platform 2.5 for RHEL 8; and 36 more.
High [CVE-2026-24006] Denial of Service due to excessive recursion during object serialization
Denial of Service due to excessive recursion during object serialization. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-24001] denial of service vulnerability in parsePatch and applyPatch
denial of service vulnerability in parsePatch and applyPatch. Red Hat rates this important (CVSS 7.5). Weakness: CWE-400. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Satellite 6.
High [CVE-2026-23957] Denial of Service via large encoded array lengths
Denial of Service via large encoded array lengths. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-23956] Denial of Service via malicious regular expressions during deserialization
Denial of Service via malicious regular expressions during deserialization. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1333. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-71176] Denial of Service or Privilege Escalation via insecure temporary directory handling
Denial of Service or Privilege Escalation via insecure temporary directory handling. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-379. Affected package(s): pytest-main. Resolved in Red Hat advisory RHSA-2026:8580 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-23893] Privilege Escalation or Data Exposure via Symlink Following
Privilege Escalation or Data Exposure via Symlink Following. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-59. Affected package(s): opencryptoki. Resolved in Red Hat advisory RHSA-2026:4717 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.