Complete feed
Security advisories & CVEs
5260 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-21884] @remix-run/react: React Router SSR XSS in ScrollRestoration
@remix-run/react: React Router SSR XSS in ScrollRestoration. Red Hat rates this important (CVSS 8.2). Weakness: CWE-79. Affected package(s): rhoai/odh-mod-arch-model-registry-rhel9:1778666987, rhoai/odh-mod-arch-gen-ai-rhel9:1778473763, rhoai/odh-dashboard-rhel9:1779189627, ansible-automation-platform, automation-platform-ui, rhoai/odh-dashboard-rhel9:1772093424. Resolved in Red Hat advisory RHSA-2026:19712 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3.
High [CVE-2025-59057] @remix-run/router: React Router XSS Vulnerability
@remix-run/router: React Router XSS Vulnerability. Red Hat rates this important (CVSS 7.6). Weakness: CWE-79. Affected package(s): rhoai/odh-mod-arch-model-registry-rhel9:1778666987, rhoai/odh-mod-arch-gen-ai-rhel9:1778473763, rhoai/odh-dashboard-rhel9:1779189627, ansible-automation-platform, automation-platform-ui, rhoai/odh-dashboard-rhel9:1772093424. Resolved in Red Hat advisory RHSA-2026:19712 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3.
Medium [CVE-2026-0822] Heap-based buffer overflow in js_typed_array_sort function
Heap-based buffer overflow in js_typed_array_sort function. Red Hat rates this important (CVSS 6.3). Weakness: CWE-787. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-22773] Denial of Service via specially crafted image in multimodal model serving
Denial of Service via specially crafted image in multimodal model serving. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770. Affected package(s): rhaiis/vllm-spyre-rhel9:1782352919, rhoai/odh-vllm-cpu-rhel9:1776259063, rhaiis/vllm-cuda-rhel9:1772160593, rhaiis/vllm-rocm-rhel9:1772160625. Resolved in Red Hat advisory RHSA-2026:10184 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-22693] Null Pointer Dereference in harfbuzz
Null Pointer Dereference in harfbuzz. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-476. Affected package(s): harfbuzz-main. Resolved in Red Hat advisory RHSA-2026:7701 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Critical [CVE-2025-70974] Remote Code Execution via JNDI Injection due to autoType mishandling
Remote Code Execution via JNDI Injection due to autoType mishandling. Red Hat rates this critical (CVSS 10). Weakness: CWE-829. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2025-9222] Stored Cross-Site Scripting via GitLab Flavored Markdown
Stored Cross-Site Scripting via GitLab Flavored Markdown. Red Hat rates this important (CVSS 8.7). Weakness: CWE-79. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2025-13772] Unauthorized access to AI model settings via namespace identifier manipulation
Unauthorized access to AI model settings via namespace identifier manipulation. Red Hat rates this important (CVSS 7.1). Weakness: CWE-862. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2025-13761] Cross-Site Scripting Vulnerability Leading to Arbitrary Code Execution
Cross-Site Scripting Vulnerability Leading to Arbitrary Code Execution. Red Hat rates this important (CVSS 8). Weakness: CWE-79. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Critical [CVE-2025-12543] Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF. Red Hat rates this important (CVSS 9.6). Weakness: CWE-20. Affected package(s): eap8-wildfly, eap8-undertow, eap8-apache-cxf, eap8-wildfly-clustering, eap8-bouncycastle, eap7-undertow. Resolved in Red Hat advisory RHSA-2026:3889 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7; Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7; Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7; Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8; and 10 more.
High [CVE-2025-67858] Integrity loss of firewall configuration via improper neutralization of argument delimiters
Integrity loss of firewall configuration via improper neutralization of argument delimiters. Red Hat rates this important (CVSS 7.8). Weakness: CWE-88. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2025-14459] Unauthorized PVC Cloning via DataImportCron
Unauthorized PVC Cloning via DataImportCron. Red Hat rates this important (CVSS 8.5). Weakness: CWE-639. Affected package(s): container-native-virtualization/ovs-cni-plugin-rhel9:v4.19.17, container-native-virtualization/vm-network-latency-checkup-rhel9:v4.19.17, container-native-virtualization/kubesecondarydns-rhel9:v4.19.17, container-native-virtualization/aaq-controller-rhel9:v4.19.17, container-native-virtualization/kubevirt-template-validator-rhel9:v4.19.17, container-native-virtualization/virt-handler-rhel9:v4.19.17. Resolved in Red Hat advisory RHSA-2026:0950 — update the affected packages (`sudo dnf update`). Affected product named by the advisory: RHEL-9-CNV-4.19.
High [CVE-2026-0719] Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication
Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication. Red Hat rates this important (CVSS 8.6). Weakness: CWE-121. Affected package(s): libsoup, spice-client-win, devspaces/pluginregistry-rhel9:1770918006, devspaces/openvsx-rhel9:1770851052, devspaces/udi-rhel9:1770913862, libsoup3. Resolved in Red Hat advisory RHSA-2026:2513 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 11 more.
High [CVE-2025-50334] Denial of Service via rate-limiting component
Denial of Service via rate-limiting component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2025-65518] Denial of Service via crafted request to get_password.php
Denial of Service via crafted request to get_password.php. Red Hat rates this important (CVSS 7.5). Weakness: CWE-606. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-68158] Cross-Site Request Forgery due to improper session management in state storage
Cross-Site Request Forgery due to improper session management in state storage. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-352. Affected package(s): quay/quay-rhel9:1775069491, quay/quay-rhel9:1775169226, quay/quay-rhel8:1775169219, satellite/foreman-mcp-server-rhel9:1782228427. Resolved in Red Hat advisory RHSA-2026:6568 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-68151] github.com/coredns/coredns/core/dnsserver: CoreDNS DoS via unbounded connections and oversized messages
github.com/coredns/coredns/core/dnsserver: CoreDNS DoS via unbounded connections and oversized messages. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Affected package(s): rhacm2/lighthouse-coredns-rhel9:1774086225, rhacm2/lighthouse-coredns-rhel9:1780204249. Resolved in Red Hat advisory RHSA-2026:8151 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-22028] Arbitrary script execution via JSON serialization protection bypass
Arbitrary script execution via JSON serialization protection bypass. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-843. Affected package(s): openshift4/ose-agent-installer-ui-rhel9:1774977480. Resolved in Red Hat advisory RHSA-2026:6564 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-14017] Security bypass due to global TLS option changes in multi-threaded LDAPS transfers
Security bypass due to global TLS option changes in multi-threaded LDAPS transfers. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-1058. Affected package(s): curl-main. Resolved in Red Hat advisory RHSA-2026:6893 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-66560] Quarkus REST Worker Thread Exhaustion Vulnerability
Quarkus REST Worker Thread Exhaustion Vulnerability. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-772. Affected package(s): quarkus-rest. Resolved in Red Hat advisory RHSA-2026:1899 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.