Complete feed
Security advisories & CVEs
3448 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-19481] Denial of Service from crafted form-data headers
Denial of Service from crafted form-data headers. Red Hat rates this important (CVSS 7.5). Weakness: CWE-915. Affected products named by the advisory: OpenShift Pipelines; Red Hat AMQ Broker 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; and 2 more. Affected products named by the advisory: Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4.
High [CVE-2026-67986] Arbitrary code execution via Ruby code injection in AwesomeMethodArray#grep
Arbitrary code execution via Ruby code injection in AwesomeMethodArray#grep. Red Hat rates this important (CVSS 7.8). Weakness: CWE-94.
High [CVE-2026-68453] Fix buffer over-read in cca_cipher2protkey
Fix buffer over-read in cca_cipher2protkey. Red Hat rates this moderate (CVSS 7). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
High [CVE-2026-68452] Validate length for CCA AES cipher key requests
Validate length for CCA AES cipher key requests. Red Hat rates this moderate (CVSS 7). Weakness: CWE-120. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
High [CVE-2026-68451] Validate length for CCA ECC private key requests
Validate length for CCA ECC private key requests. Red Hat rates this moderate (CVSS 7). Weakness: CWE-805. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
High [CVE-2026-46382] Server-Side Request Forgery in import functionality
Server-Side Request Forgery in import functionality. Red Hat rates this important (CVSS 7.5). Weakness: CWE-918.
High [CVE-2026-71469] Unbounded tokenReviews cache allows unauthenticated memory-exhaustion DoS
Unbounded tokenReviews cache allows unauthenticated memory-exhaustion DoS. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:60391 with package rhacm2/acm-search-v2-api-rhel9:1787191668, rhacm2/acm-search-v2-api-rhel9:1787263804, rhacm2/acm-search-v2-api-rhel9:1787238618, rhacm2/acm-search-v2-api-rhel9:1787229541. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
High [CVE-2026-71473] addonfactory.GetValuesFromAddonAnnotation enables arbitrary Helm-values override per spoke
addonfactory. GetValuesFromAddonAnnotation enables arbitrary Helm-values override per spoke. Red Hat rates this important (CVSS 8.5). Weakness: CWE-915. Red Hat lists fixing advisory RHSA-2026:60391 with package rhacm2/acm-search-v2-rhel9:1787682033, rhacm2/acm-search-v2-rhel9:1787681674, rhacm2/acm-search-v2-rhel9:1787681686, rhacm2/acm-search-v2-rhel9:1787682112. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
High [CVE-2026-73500] Denial of Service via unbounded TLS handshake goroutines
Denial of Service via unbounded TLS handshake goroutines. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Ansible Automation Platform 2; Red Hat Ceph Storage 5; and 11 more. Affected products named by the advisory: Red Hat Ceph Storage 6; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; and 7 more.
High [CVE-2026-19654] Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected. This vulnerability in rsyslog allows an unauthenticated peer to crash the rsyslogd deamon, resulting a a Denial-of-Service, by sending a crafted input sequence. This happens because the malicious input ends creating an invalid internal message length, which crashes the rsyslogd receiving the input. This vulnerability is only exploitable when the following conditions are met: * imptcp module is explicitly loaded * There's an imptcp listener using the non-default framing.delimiter.regex mode * The attacker is able to establish a TCP connection to the target listener Although this vulnerability has been rated as having an Important severity in upstream, the Red Hat Product Security team has rated it as having a MODERATE severity in supported Red Hat Products. This happens because the conditions described above are not met in default configurations of the `rsyslog` package as shipped with Red Hat Enterprise Linux Versions. Weakness: CWE-125.
High [CVE-2026-13622] virt-handler migration proxy follows symlinks allowing container escape to host
virt-handler migration proxy follows symlinks allowing container escape to host. Red Hat rates this important (CVSS 8.8). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:53763 with package container-native-virtualization/virt-handler-rhel9:1786348529, container-native-virtualization/virt-handler-rhel9:1786309624, container-native-virtualization/virt-handler:1785837722, container-native-virtualization/virt-handler-rhel9:1786334215. Affected products named by the advisory: Red Hat Container Native Virtualization 4.12; Red Hat Container Native Virtualization 4.13; Red Hat Container Native Virtualization 4.14; Red Hat Container Native Virtualization 4.15; and 7 more. Affected products named by the advisory: Red Hat Container Native Virtualization 4.16; Red Hat Container Native Virtualization 4.17; Red Hat Container Native Virtualization 4.18; Red Hat Container Native Virtualization 4.19; and 3 more.
High [CVE-2026-73422] Arbitrary code execution via unescaped View Transition animation properties
Arbitrary code execution via unescaped View Transition animation properties. Red Hat rates this important (CVSS 8.1). Weakness: CWE-79. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
High [CVE-2026-73415] Arbitrary code execution via malicious image in image viewer
Arbitrary code execution via malicious image in image viewer. Red Hat rates this important (CVSS 8). Weakness: CWE-911. Affected products named by the advisory: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-15217] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.
High [CVE-2026-15216] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.
High [CVE-2026-16494] GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.
High [CVE-2026-19228] GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.
High [CVE-2026-15423] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.
High [CVE-2026-16627] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.
High [CVE-2026-0295] GlobalProtect App: Local Privilege Escalation via Race Condition on macOS
CVE-2026-0295 GlobalProtect App: Local Privilege Escalation via Race Condition on macOS