Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-73072] Heap buffer overflow allows arbitrary code execution
Heap buffer overflow allows arbitrary code execution. Red Hat rates this important (CVSS 7.8). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: vim.
High [CVE-2026-14380 +1] Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute
Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute. Red Hat rates this important (CVSS 8.8). Weakness: CWE-94. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: perl-dbi.
High [CVE-2026-73066] Heap out-of-bounds write via crafted.traineddata
Heap out-of-bounds write via crafted.traineddata. Red Hat rates this important (CVSS 7.1). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: tesseract.
High [CVE-2026-72746] Authentication bypass in RDSTLS handshake via PDU-type confusion
Authentication bypass in RDSTLS handshake via PDU-type confusion. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1287. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
High [CVE-2026-50236] Authenticated SSRF with full response reflection and path neutralization via Dev Console webhook helpers in OpenShift Console
Authenticated SSRF with full response reflection and path neutralization via Dev Console webhook helpers in OpenShift Console. Red Hat rates this important (CVSS 7.4). Weakness: CWE-918. Red Hat lists fixing advisory RHSA-2026:56789 with package openshift4/ose-console:1787028559, openshift4/ose-console-rhel9:1786534931, openshift4/ose-console-rhel9:1786486822, openshift4/ose-console-rhel9:1786607915. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.14; Red Hat OpenShift Container Platform 4.15; Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.18; and 4 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.19; Red Hat OpenShift Container Platform 4.20; Red Hat OpenShift Container Platform 4.21; Red Hat OpenShift Container Platform 4.22.
High [CVE-2026-50237] Namespace tenant SSRF with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via ProjectHelmChartRepository in OpenShift Console
Namespace tenant SSRF with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via ProjectHelmChartRepository in OpenShift Console. Red Hat rates this important (CVSS 7.4). Weakness: CWE-918. Red Hat lists fixing advisory RHSA-2026:56789 with package openshift4/ose-console:1787028559, openshift4/ose-console-rhel9:1786534931, openshift4/ose-console-rhel9:1786486822, openshift4/ose-console-rhel9:1786607915. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.12; Red Hat OpenShift Container Platform 4.13; Red Hat OpenShift Container Platform 4.14; Red Hat OpenShift Container Platform 4.15; and 6 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.18; Red Hat OpenShift Container Platform 4.19; Red Hat OpenShift Container Platform 4.20; and 2 more.
High [CVE-2026-72552] Server-Side Request Forgery allows information disclosure and internal network scanning
Server-Side Request Forgery allows information disclosure and internal network scanning. Red Hat rates this important (CVSS 7.5). Weakness: CWE-918.
High [CVE-2026-71217] iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion
iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion. Red Hat rates this important (CVSS 7.5). Weakness: CWE-20. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-15567] Pre-auth denial of service on the IIOP listener
Pre-auth denial of service on the IIOP listener. Red Hat rates this important (CVSS 7.5). Red Hat lists fixing advisory RHSA-2026:53806. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-15565] Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method
Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method. Red Hat rates this important (CVSS 7.5). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:53806. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-15563] Missing authentication on EAP's IIOP NameService leads to MITM or DoS
Missing authentication on EAP's IIOP NameService leads to MITM or DoS. Red Hat rates this important (CVSS 7.4). Weakness: CWE-306. Red Hat lists fixing advisory RHSA-2026:53806 with package eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap, eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap, eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-15562] integer overflow in MessageReader leads to pre-authentication denial of service
integer overflow in MessageReader leads to pre-authentication denial of service. Red Hat rates this important (CVSS 7.5). Weakness: CWE-190. Red Hat lists fixing advisory RHSA-2026:53806 with package eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap, eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap, eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-15561] OOM via missing limits in chunked trailer in EAP's Undertow
OOM via missing limits in chunked trailer in EAP's Undertow. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:53806 with package eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap, eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap, eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-15560] unauthed class loading via IIOP in EAP
unauthed class loading via IIOP in EAP. Red Hat rates this important (CVSS 8.1). Weakness: CWE-829. Red Hat lists fixing advisory RHSA-2026:53806 with package eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap, eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap, openjdk-orb. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-15556] picketlink SAML 2.0 auth bypass via missing assertions
picketlink SAML 2.0 auth bypass via missing assertions. Red Hat rates this important (CVSS 8.1). Weakness: CWE-347. Red Hat lists fixing advisory RHSA-2026:53806 with package eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap, eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap, eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap. Affected product named by the advisory: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7.
High [CVE-2026-15555] wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller
wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller. Red Hat rates this important (CVSS 8.8). Weakness: CWE-502. Red Hat lists fixing advisory RHSA-2026:53806 with package eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap, eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap, eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack.
High [CVE-2026-15554] Authentication Bypass via AJP ssl_cert/is_ssl Forgery
Authentication Bypass via AJP ssl_cert/is_ssl Forgery. Red Hat rates this important (CVSS 7.4). Weakness: CWE-295. Red Hat lists fixing advisory RHSA-2026:53806 with package eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap, eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap, eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-72693] Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login. Red Hat rates this moderate (CVSS 7.8). Weakness: CWE-284. Red Hat lists fixing advisory RHSA-2026:41136 with package kbd-0:2.4.0-12.el9_8, kbd-0:2.6.4-8.el10_2, kbd-main-2.10.0-2.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10.
High [CVE-2026-72694] MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation
MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation. Red Hat rates this important (CVSS 7.1). Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:57596 with package mrtg-0:2.17.10-12.el10_2.1, mrtg-0:2.17.7-12.el9_8.1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9.
High [CVE-2026-6726] MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse
MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.