Complete feed
Recently updated
Advisories the vendor has revised
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Medium [CVE-2026-61632] Information disclosure via path traversal in b64 extension
Information disclosure via path traversal in b64 extension. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22. Affected products named by the advisory: Red Hat Developer Hub; Red Hat OpenShift Container Platform 4; Self-service automation portal 2.
Medium [CVE-2026-19167] Cross-origin data leakage via integer overflow in GPU
Cross-origin data leakage via integer overflow in GPU. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-190.
Medium [CVE-2026-19146] Google Chrome (Android): Information disclosure via uninitialized GPU memory use
Google Chrome (Android): Information disclosure via uninitialized GPU memory use. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-824.
Medium [CVE-2026-19139] OS-level privilege escalation due to a race condition via a malicious file
OS-level privilege escalation due to a race condition via a malicious file. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-367.
Medium [CVE-2026-71439] Denial of Service via Radar Diagrams 'ticks' parameter
Denial of Service via Radar Diagrams 'ticks' parameter. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1050.
Medium [CVE-2026-71438] Prototype pollution vulnerability via configuration APIs
Prototype pollution vulnerability via configuration APIs. Red Hat rates this moderate (CVSS 4). Weakness: CWE-915. Affected products named by the advisory: Red Hat Build of Podman Desktop; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Dev Spaces.
Medium [CVE-2026-50159] CSS injection allows altering page elements via diagram input
CSS injection allows altering page elements via diagram input. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-79.
Medium [CVE-2026-71437] Prototype pollution vulnerability allows potential arbitrary code execution
Prototype pollution vulnerability allows potential arbitrary code execution. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-915.
Medium [CVE-2026-64654] Terminal escape sequence injection allows command execution
Terminal escape sequence injection allows command execution. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-78.
Medium [CVE-2026-64653] Path traversal via unescaped URL variables
Path traversal via unescaped URL variables. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-22.
Medium [CVE-2026-43630] Information disclosure via out-of-bounds read
Information disclosure via out-of-bounds read. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125.
Medium [CVE-2026-70639] Denial of Service in Android JNI wrapper via malicious model file
Denial of Service in Android JNI wrapper via malicious model file. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476.
Medium [CVE-2025-49506] Information disclosure via timing attack in password validation
Information disclosure via timing attack in password validation. Red Hat rates this low (CVSS 5.9). Weakness: CWE-208. Red Hat lists fixing advisory RHSA-2026:58474 with package apr-util-main-1.6.5-1.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: apr-util.
Medium [CVE-2026-32327] Denial of Service via XML stack recursion attack
Denial of Service via XML stack recursion attack. Red Hat rates this moderate (CVSS 6.2). Weakness: CWE-776. Red Hat lists fixing advisory RHSA-2026:58474 with package apr-util-main-1.6.5-1.hum1.
Medium [CVE-2026-57818] Authorization Code Replay via Race Condition
Authorization Code Replay via Race Condition. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-639. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat JBoss Web Server 5.
Medium [CVE-2026-68079] Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider
Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-613. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat JBoss Web Server 5.
Medium [CVE-2026-68481] Revocation bypass allows unauthorized access
Revocation bypass allows unauthorized access. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-303. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat JBoss Web Server 5.
Medium [CVE-2026-64640] Apache Polaris did not consistently validate storage locations supplied during table and view registration
Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials to read a caller-selected Iceberg metadata file before verifying that the file was within the catalog's allowed storage locations. If the catalog's underlying credentials could read an object outside that boundary, this could disclose limited information from the object. Polaris could also accept registration metadata located within an allowed location that contained references to storage locations outside the allowed boundary. This second condition did not itself cause Polaris to read the referenced external locations during registration. The demonstrated impact is limited to confidentiality. No unauthorized data modification or availability impact has been demonstrated. The server-side read requires a deployment using S3 credential vending and an object outside the allowed locations that the catalog's underlying storage credentials can read. Exploitation requires an authenticated principal with table- or view-registration privileges.
Medium [CVE-2026-18967] SAML OneTimeUse assertion replay in IdP-Initiated broker flow
SAML OneTimeUse assertion replay in IdP-Initiated broker flow. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-294. Affected products named by the advisory: Red Hat Build of Keycloak; Red Hat JBoss Enterprise Application Platform Expansion Pack.
Medium [CVE-2026-19028] Denial of Service via integer underflow in Fletcher32 filter
Denial of Service via integer underflow in Fletcher32 filter. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images.