Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2530 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 50 critical, 895 high, 1324 medium, 259 low.
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-101607] Denial of Service in Server Optimizer
Denial of Service in Server Optimizer. Red Hat rates this moderate (CVSS 4.9). Weakness: CWE-835. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: mysql8.4.
Medium [CVE-2026-101608] Denial of Service via Server Optimizer component
Denial of Service via Server Optimizer component. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-400. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: mysql8.4.
Medium [CVE-2026-113812] Mozilla::CA: TLS server impersonation via compromised intermediate certificates
Mozilla::CA: TLS server impersonation via compromised intermediate certificates. Red Hat rates this important (CVSS 6.8). Weakness: CWE-295. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat package: perl-mozilla-ca.
Medium [CVE-2026-113867] Unauthorized actions via XMPP stanza injection
Unauthorized actions via XMPP stanza injection. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-91. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: thunderbird.
Medium [CVE-2026-113869] Use-after-free in S/MIME decryption during a security device password prompt
Use-after-free in S/MIME decryption during a security device password prompt. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: thunderbird.
Medium [CVE-2026-113868] information disclosure via malformed authentication challenge
information disclosure via malformed authentication challenge. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-908. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: thunderbird.
Medium [CVE-2026-113866] Information disclosure via unencrypted AutoDiscover lookup
Information disclosure via unencrypted AutoDiscover lookup. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-523. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: thunderbird.
Medium [CVE-2026-111767] @modelcontextprotocol/sdk: @modelcontextprotocol/sdk: Unauthorized cross-session task access via taskStore
@modelcontextprotocol/sdk: @modelcontextprotocol/sdk: Unauthorized cross-session task access via taskStore. Red Hat rates this important (CVSS 6.3). Weakness: CWE-639. Affected products named by the advisory: Migration Toolkit for Applications 8; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat OpenShift AI (RHOAI); and 3 more. Affected products named by the advisory: Red Hat OpenShift Dev Spaces; Red Hat package: goose; Red Hat package: grafana.
Medium [CVE-2026-113661] Cross-site scripting via unsafe meta refresh content attributes
Cross-site scripting via unsafe meta refresh content attributes. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79. Affected products named by the advisory: Cost Management On Premise; Multicluster Engine for Kubernetes; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Enterprise Linux 10; and 7 more. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; and 3 more.
Medium [CVE-2026-92539] Unauthorized cross-organization user management via the SCIM API
Unauthorized cross-organization user management via the SCIM API. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-639. Red Hat lists fixing advisory RHSA-2026:85295 with package grafana12-4-main-12.4.13-0.1.hum1, grafana13-2-main-13.2.4-0.1.hum1, grafana13-1-main-13.1.8-0.3.hum1. Affected products named by the advisory: Red Hat Hardened Images; Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Ceph Storage 7; and 6 more. Affected products named by the advisory: Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; and 2 more.
Medium [CVE-2026-113654] HTML sanitization bypass via improper noscript tag handling
HTML sanitization bypass via improper noscript tag handling. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-79. Affected products named by the advisory: Cost Management On Premise; Multicluster Engine for Kubernetes; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Enterprise Linux 10; and 6 more. Affected products named by the advisory: Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat Quay 3; and 2 more.
Medium [CVE-2026-113650] Denial of Service via unbounded recursion in iframe tag processing
Denial of Service via unbounded recursion in iframe tag processing. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-835. Affected products named by the advisory: Cost Management On Premise; Multicluster Engine for Kubernetes; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Enterprise Linux 10; and 7 more. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; and 3 more.
Medium [CVE-2026-101356] Information disclosure via incorrect object recycling in HTTP/2 processing
Information disclosure via incorrect object recycling in HTTP/2 processing. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-488. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: tomcat9.
Medium [CVE-2026-93446] Possible TLS 1.3 connection failures
Possible TLS 1.3 connection failures. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-459. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 8 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat JBoss Web Server 5; Red Hat JBoss Web Server 6; and 4 more.
Medium [CVE-2026-113351] Denial of Service via improper memory tracking in XML_ParserReset
Denial of Service via improper memory tracking in XML_ParserReset. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-459. Red Hat lists fixing advisory RHSA-2026:90325 with package expat-main-2.9.0-1.1.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 9 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4; Red Hat package: expat; and 5 more.
Medium [CVE-2026-101201] Denial of Service via out-of-bounds read in QBinaryJson
Denial of Service via out-of-bounds read in QBinaryJson. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 3 more. Affected products named by the advisory: Red Hat Hardened Images; Red Hat package: qt6-qt5compat; Red Hat package: qt5-qtbase.
Medium [CVE-2026-110306] Cross-Site Scripting via improper URI scheme decoding
Cross-Site Scripting via improper URI scheme decoding. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-1286. Red Hat lists fixing advisory RHSA-2026:90388 with package grafana12-4-main-12.4.13-0.4.hum1, grafana13-1-main-13.1.8-0.5.hum1, grafana13-2-main-13.2.4-0.4.hum1, grafana12-4-main-12.4.13-0.5.hum1. Affected products named by the advisory: Cost Management On Premise; Cryostat 4; Migration Toolkit for Applications 8; Multicluster Engine for Kubernetes; and 32 more. Affected products named by the advisory: Network Observability Operator; OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; and 28 more.
Medium [CVE-2026-110180] Security policy bypass via improper host canonicalization
Security policy bypass via improper host canonicalization. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-1286. Red Hat lists fixing advisory RHSA-2026:90388 with package grafana12-4-main-12.4.13-0.4.hum1, grafana13-1-main-13.1.8-0.5.hum1, grafana13-2-main-13.2.4-0.4.hum1, grafana12-4-main-12.4.13-0.5.hum1. Affected products named by the advisory: Cost Management On Premise; Cryostat 4; Migration Toolkit for Applications 8; Multicluster Engine for Kubernetes; and 32 more. Affected products named by the advisory: Network Observability Operator; OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; and 28 more.
Low [CVE-2026-91409] Enhance QUIC connections (Oracle CPU 2026-10)
Enhance QUIC connections (Oracle CPU 2026-10). Red Hat rates this low (CVSS 3.7). Weakness: CWE-770. Affected products named by the advisory: Red Hat build of OpenJDK 11 ELS; Red Hat build of OpenJDK 17; Red Hat build of OpenJDK 21; Red Hat build of OpenJDK 25; and 14 more. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 10 more.
Low [CVE-2026-91381] Enhance Font Rendering (Oracle CPU 2026-10)
Enhance Font Rendering (Oracle CPU 2026-10). Red Hat rates this low (CVSS 3.7). Weakness: CWE-749. Affected products named by the advisory: Red Hat build of OpenJDK 1.8; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 6 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: java-1.6.0-openjdk; Red Hat package: java-1.7.0-openjdk; and 2 more.