Complete feed
Security advisories & CVEs
7846 advisories across 32 monitored vendors.
Android app · Google Play
Take your CVE monitoring with you.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
High [CVE-2026-63076] invalid pointer dereference in CMP server via crafted protectionAlg
invalid pointer dereference in CMP server via crafted protectionAlg. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:59641 with package openssl3-main-3.5.8-0.1.hum1, openssl-main-3.5.8-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Developer Hub; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; and 8 more. Affected products named by the advisory: Red Hat JBoss Core Services; Red Hat JBoss Web Server 6; Red Hat JBoss Web Server 7; Red Hat OpenShift Container Platform 4; and 4 more.
High [CVE-2026-14457] RPK server signature algorithm selection can dereference a missing certificate
RPK server signature algorithm selection can dereference a missing certificate. Red Hat rates this low (CVSS 7.5). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:59641 with package openssl3-main-3.5.8-0.1.hum1, openssl-main-3.5.8-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Developer Hub; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; and 6 more. Affected products named by the advisory: Red Hat JBoss Core Services; Red Hat JBoss Web Server 6; Red Hat JBoss Web Server 7; Red Hat OpenShift Container Platform 4; and 2 more.
High [CVE-2026-54874] excessive memory use buffering DTLS records for a future epoch
excessive memory use buffering DTLS records for a future epoch. Red Hat rates this low (CVSS 7.5). Weakness: CWE-405. Red Hat lists fixing advisory RHSA-2026:59641 with package openssl3-main-3.5.8-0.1.hum1, openssl-main-3.5.8-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Developer Hub; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; and 18 more. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat JBoss Core Services; and 14 more.
High [CVE-2026-63074] CMP indefinite cache growth of ExtraCerts
CMP indefinite cache growth of ExtraCerts. Red Hat rates this low (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:59641 with package openssl3-main-3.5.8-0.1.hum1, openssl-main-3.5.8-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Developer Hub; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; and 8 more. Affected products named by the advisory: Red Hat JBoss Core Services; Red Hat JBoss Web Server 6; Red Hat JBoss Web Server 7; Red Hat OpenShift Container Platform 4; and 4 more.
High [CVE-2026-52491] Arbitrary code execution via thumbnail.c: main component
Arbitrary code execution via thumbnail.c: main() component. Red Hat rates this important (CVSS 7.3). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:53467 with package libtiff-main-4.7.2-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 5 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libtiff; Red Hat package: compat-libtiff3; and 1 more.
Medium [CVE-2026-80185] unprivileged-local and adjacent-LE-peer leads to arbitrary code execution as root
unprivileged-local and adjacent-LE-peer leads to arbitrary code execution as root. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-843. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: bluez.
Medium [CVE-2026-80101] Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation
A flaw was found in the file-xwd plugin in GIMP. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service, or a limited information disclosure of heap memory contents into the produced image. To exploit this vulnerability, an attacker needs to convince a user to process a specially crafted XWD image with GIMP, reducing the likelihood of exploitation. Due to this reason, this flaw has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: gimp.
Medium [CVE-2025-32907 +1] quadratic CPU denial of service in HTTP Range coalescing after CVE-2025-32907 fix
quadratic CPU denial of service in HTTP Range coalescing after CVE-2025-32907 fix. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-407. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: libsoup3.
Medium [CVE-2026-79258] Information disclosure via incorrect authorization
Information disclosure via incorrect authorization. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-346.
Medium [CVE-2026-79276] Privilege management bypass via crafted HTML page
Privilege management bypass via crafted HTML page. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-266.
Medium [CVE-2026-79772] Signature validation bypass via unchecked return value
Signature validation bypass via unchecked return value. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-252. Affected products named by the advisory: Red Hat 3scale API Management Platform 2; Red Hat Satellite 6.
Medium [CVE-2026-79771] Denial of Service via XSLT transform memory leak
Denial of Service via XSLT transform memory leak. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Affected products named by the advisory: Red Hat 3scale API Management Platform 2; Red Hat Satellite 6.
Medium [CVE-2026-79769] Process crash due to invalid memory read via programming error in internal method
Process crash due to invalid memory read via programming error in internal method. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-843. Affected products named by the advisory: Red Hat 3scale API Management Platform 2; Red Hat Satellite 6.
Medium [CVE-2026-79676] Information disclosure via path traversal with symlink bypass
Information disclosure via path traversal with symlink bypass. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-22. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; and 1 more. Affected products named by the advisory: Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-79717] blind SSRF via namespace avatar_url with no private-address restriction
blind SSRF via namespace avatar_url with no private-address restriction. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-918. Affected product named by the advisory: Red Hat Ansible Automation Platform 2.
Medium [CVE-2026-16599] Denial of Service via crafted FTP OPIE/S-KEY authentication challenge
Denial of Service via crafted FTP OPIE/S-KEY authentication challenge. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-835. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: wget.
Medium [CVE-2026-78684] Denial of Service via DeepStream backend resource control bypass.
Denial of Service via DeepStream backend resource control bypass. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Affected products named by the advisory: Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-79652] JWT Bearer authorization grant does not enforce consentRequired
JWT Bearer authorization grant does not enforce consentRequired. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-77117] Non-progress DoS in SHIFT_JISX0213 ->
Non-progress DoS in SHIFT_JISX0213 ->. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-835. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Hardened Images; Red Hat package: glibc.
Medium [CVE-2026-11610 +1] incomplete fix may introduce a connection-stall DoS
CVE-2026-11610 incomplete fix may introduce a connection-stall DoS. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-787. Affected products named by the advisory: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10; and 5 more. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more.