Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2534 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 50 critical, 897 high, 1326 medium, 259 low.
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-110306] Cross-Site Scripting via improper URI scheme decoding
Cross-Site Scripting via improper URI scheme decoding. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-1286. Red Hat lists fixing advisory RHSA-2026:90388 with package grafana12-4-main-12.4.13-0.4.hum1, grafana13-1-main-13.1.8-0.5.hum1, grafana13-2-main-13.2.4-0.4.hum1, grafana12-4-main-12.4.13-0.5.hum1. Affected products named by the advisory: Cost Management On Premise; Cryostat 4; Migration Toolkit for Applications 8; Multicluster Engine for Kubernetes; and 32 more. Affected products named by the advisory: Network Observability Operator; OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; and 28 more.
Medium [CVE-2026-110180] Security policy bypass via improper host canonicalization
Security policy bypass via improper host canonicalization. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-1286. Red Hat lists fixing advisory RHSA-2026:90388 with package grafana12-4-main-12.4.13-0.4.hum1, grafana13-1-main-13.1.8-0.5.hum1, grafana13-2-main-13.2.4-0.4.hum1, grafana12-4-main-12.4.13-0.5.hum1. Affected products named by the advisory: Cost Management On Premise; Cryostat 4; Migration Toolkit for Applications 8; Multicluster Engine for Kubernetes; and 32 more. Affected products named by the advisory: Network Observability Operator; OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; and 28 more.
Low [CVE-2026-91409] Enhance QUIC connections (Oracle CPU 2026-10)
Enhance QUIC connections (Oracle CPU 2026-10). Red Hat rates this low (CVSS 3.7). Weakness: CWE-770. Affected products named by the advisory: Red Hat build of OpenJDK 11 ELS; Red Hat build of OpenJDK 17; Red Hat build of OpenJDK 21; Red Hat build of OpenJDK 25; and 14 more. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 10 more.
Low [CVE-2026-91381] Enhance Font Rendering (Oracle CPU 2026-10)
Enhance Font Rendering (Oracle CPU 2026-10). Red Hat rates this low (CVSS 3.7). Weakness: CWE-749. Affected products named by the advisory: Red Hat build of OpenJDK 1.8; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 6 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: java-1.6.0-openjdk; Red Hat package: java-1.7.0-openjdk; and 2 more.
Low [CVE-2026-101779] Partial Denial of Service via Telemetry component
Partial Denial of Service via Telemetry component. Red Hat rates this low (CVSS 2.7). Weakness: CWE-400. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: mysql8.4.
Low [CVE-2026-113657] arbitrary script execution via namespace-prefixed SVG animation elements
arbitrary script execution via namespace-prefixed SVG animation elements. Red Hat rates this low (CVSS 3.7). Weakness: CWE-79. Affected products named by the advisory: Cost Management On Premise; Multicluster Engine for Kubernetes; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Enterprise Linux 10; and 7 more. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; and 3 more.
Low [CVE-2026-88041] Information disclosure via incomplete HTTP trailer cleanup
Information disclosure via incomplete HTTP trailer cleanup. Red Hat rates this low (CVSS 3.7). Weakness: CWE-459. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 3 more. Affected products named by the advisory: Red Hat JBoss Web Server 6; Red Hat JBoss Web Server 7; Red Hat package: tomcat9.
Low [CVE-2026-80353] Unauthorized socket access via TOCTOU race condition
Unauthorized socket access via TOCTOU race condition. Red Hat rates this low (CVSS 3.6). Weakness: CWE-367. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 3 more. Affected products named by the advisory: Red Hat JBoss Web Server 5; Red Hat package: tomcat9; Red Hat package: pki-servlet-engine.
Low [CVE-2026-74049] Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE). Red Hat rates this low (CVSS 3.7). Weakness: CWE-698. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 8 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat JBoss Web Server 5; Red Hat JBoss Web Server 6; and 4 more.
Low [CVE-2026-74048] Cryptographic policy bypass via FIPS activation failure
Cryptographic policy bypass via FIPS activation failure. Red Hat rates this low (CVSS 3.7). Weakness: CWE-455. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 3 more. Affected products named by the advisory: Red Hat JBoss Web Server 6; Red Hat JBoss Web Server 7; Red Hat package: tomcat9.
Low [CVE-2026-110725] Cross-site scripting via unescaped colon in relative URI paths
Cross-site scripting via unescaped colon in relative URI paths. Red Hat rates this low (CVSS 3.7). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:90388 with package grafana12-4-main-12.4.13-0.4.hum1, grafana13-1-main-13.1.8-0.5.hum1, grafana13-2-main-13.2.4-0.4.hum1, grafana12-4-main-12.4.13-0.5.hum1. Affected products named by the advisory: Cost Management On Premise; Cryostat 4; Migration Toolkit for Applications 8; Multicluster Engine for Kubernetes; and 32 more. Affected products named by the advisory: Network Observability Operator; OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; and 28 more.
Low [CVE-2026-110095] Path traversal via improper relative URI normalization
Path traversal via improper relative URI normalization. Red Hat rates this low (CVSS 3.7). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:90388 with package grafana12-4-main-12.4.13-0.4.hum1, grafana13-1-main-13.1.8-0.5.hum1, grafana13-2-main-13.2.4-0.4.hum1, grafana12-4-main-12.4.13-0.5.hum1. Affected products named by the advisory: Cost Management On Premise; Cryostat 4; Migration Toolkit for Applications 8; Multicluster Engine for Kubernetes; and 32 more. Affected products named by the advisory: Network Observability Operator; OpenShift Lightspeed; OpenShift Pipelines; OpenShift Serverless; and 28 more.
High [CVE-2026-112897] Information disclosure via uninitialized buffer in TIFF decoding
Information disclosure via uninitialized buffer in TIFF decoding. Red Hat rates this important (CVSS 7.5). Weakness: CWE-908. Red Hat lists fixing advisory RHSA-2026:92861 with package python3.12-pillow-0:13.0.0-1.el9pc, rhoai/odh-openvino-model-server-rhel9:1792683954, rhoai/odh-training-rocm64-torch29-py312-rhel9:1792890009, rhoai/odh-training-cuda128-torch29-py312-rhel9:1792890022. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; and 8 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Lightspeed Services for OCP; and 4 more.
High [CVE-2026-112896] Denial of Service via out-of-bounds read in TIFF encoder
Denial of Service via out-of-bounds read in TIFF encoder. Red Hat rates this important (CVSS 8.2). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:92861 with package python3.12-pillow-0:13.0.0-1.el9pc, rhoai/odh-training-rocm64-torch29-py312-rhel9:1792890009, rhoai/odh-training-cuda128-torch29-py312-rhel9:1792890022. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; and 8 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Lightspeed Services for OCP; and 4 more.
High [CVE-2026-112893] Denial of Service via invalid pointer free during font rendering
Denial of Service via invalid pointer free during font rendering. Red Hat rates this important (CVSS 7.5). Weakness: CWE-763. Red Hat lists fixing advisory RHSA-2026:92861 with package python3.12-pillow-0:13.0.0-1.el9pc, rhoai/odh-training-rocm64-torch29-py312-rhel9:1792890009, rhoai/odh-training-cuda128-torch29-py312-rhel9:1792890022. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; and 8 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Lightspeed Services for OCP; and 4 more.
High [CVE-2026-112404] Denial of Service via out-of-bounds read in TIFF decoding
Denial of Service via out-of-bounds read in TIFF decoding. Red Hat rates this important (CVSS 8.2). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:92861 with package python3.12-pillow-0:13.0.0-1.el9pc, rhoai/odh-training-rocm64-torch29-py312-rhel9:1792890009, rhoai/odh-training-cuda128-torch29-py312-rhel9:1792890022. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; and 8 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Lightspeed Services for OCP; and 4 more.
High [CVE-2026-112403] Heap buffer overflow in ImagingJpegDecode
Heap buffer overflow in ImagingJpegDecode. Red Hat rates this important (CVSS 8.1). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:92861 with package python3.12-django-0:4.2.30-3.el9pc, python3.12-pillow-0:13.0.0-1.el9pc, python3.12-urllib3-0:2.8.0-1.el9pc, python3.12-pulp-ansible-1:0.28.10-1.el9pc. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; and 8 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux AI (RHEL AI) 3; and 4 more.
High [CVE-2026-112400] Denial of Service via memory exhaustion from crafted GIF image
Denial of Service via memory exhaustion from crafted GIF image. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:92861 with package python3.12-pillow-0:13.0.0-1.el9pc, rhoai/odh-training-rocm64-torch29-py312-rhel9:1792890009, rhoai/odh-training-cuda128-torch29-py312-rhel9:1792890022. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; and 8 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Lightspeed Services for OCP; and 4 more.
High [CVE-2026-112399] Denial of service via crafted APNG image
Denial of service via crafted APNG image. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:92861 with package python3.12-pillow-0:13.0.0-1.el9pc, rhoai/odh-openvino-model-server-rhel9:1792683954, rhoai/odh-kserve-controller-rhel9:1792685196, rhoai/odh-training-rocm64-torch29-py312-rhel9:1792890009. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; and 8 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Lightspeed Services for OCP; and 4 more.
High [CVE-2026-112390] Denial of Service via infinite loop during crafted MIC image parsing
Denial of Service via infinite loop during crafted MIC image parsing. Red Hat rates this important (CVSS 7.5). Weakness: CWE-835. Red Hat lists fixing advisory RHSA-2026:92861 with package python3.12-pillow-0:13.0.0-1.el9pc, rhoai/odh-openvino-model-server-rhel9:1792683954, rhoai/odh-training-rocm64-torch29-py312-rhel9:1792890009, rhoai/odh-training-cuda128-torch29-py312-rhel9:1792890022. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; and 8 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Lightspeed Services for OCP; and 4 more.