Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2554 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 51 critical, 902 high, 1334 medium, 265 low.
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-112277] Denial of Service via malformed compressed bitmaps
Denial of Service via malformed compressed bitmaps. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat package: rdesktop.
Medium [CVE-2026-112276] Denial of Service via out-of-bounds read in rasttopnm
Denial of Service via out-of-bounds read in rasttopnm. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: netpbm.
Medium [CVE-2026-112275] Denial of Service via heap-based buffer overflow in rasttopnm
Denial of Service via heap-based buffer overflow in rasttopnm. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: netpbm.
Medium [CVE-2026-112271] Denial of Service via out-of-bounds read in DisplayID parser
Denial of Service via out-of-bounds read in DisplayID parser. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: libdisplay-info.
Medium [CVE-2026-8168] Denial of Service via deeply nested SVG elements
Denial of Service via deeply nested SVG elements. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:58460 with package qt6-qtsvg-main-6.11.2-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: qt6-qtsvg; Red Hat package: qt5-qtsvg.
Medium [CVE-2026-112027] light0011 cms: Information disclosure via filename manipulation in Uploadify
light0011 cms: Information disclosure via filename manipulation in Uploadify. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: goose; Red Hat package: virt-firmware-rs.
Medium [CVE-2026-112057] Denial of Service via crafted disc image
Denial of Service via crafted disc image. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: libdvdnav.
Medium [CVE-2026-112058] Denial of Service via out-of-bounds read in set_PTT
Denial of Service via out-of-bounds read in set_PTT. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: libdvdnav.
Medium [CVE-2026-112008] Denial of Service via heap-based buffer overflow in mng_read_ordr
Denial of Service via heap-based buffer overflow in mng_read_ordr(). Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: libmng.
Low [CVE-2026-112026] light0011 cms: Information disclosure via weak password hashing
light0011 cms: Information disclosure via weak password hashing. Red Hat rates this low (CVSS 3.7). Weakness: CWE-916. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: goose; Red Hat package: virt-firmware-rs.
High [CVE-2026-111881] Denial of Service via crafted clipboard bitmap image
Denial of Service via crafted clipboard bitmap image. Red Hat rates this important (CVSS 7.6). Weakness: CWE-191. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
High [CVE-2026-110752] Denial of Service via excessive memory allocation in fragment selector
Denial of Service via excessive memory allocation in fragment selector. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 9; Red Hat package: perl-text-csv_xs.
High [CVE-2026-62439] Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash. Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: gimp.
High [CVE-2026-68498] Denial of Service via excessively long JSON property names
Denial of Service via excessively long JSON property names. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:88156 with package ocp-tools-4/jenkins-rhel8:1792044386, ocp-tools-4/jenkins-rhel9:1792040096, ocp-tools-4/jenkins-rhel9:1792040287, ocp-tools-4/jenkins-rhel9:1792040131. Affected products named by the advisory: Exploit Intelligence; OpenShift Developer Tools and Services; OpenShift Serverless; Red Hat AI Inference Server; and 20 more. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat Ansible Automation Platform 2; Red Hat build of Apache Camel for Spring Boot 4; Red Hat build of Apache Camel - HawtIO 4; and 16 more.
High [CVE-2026-86047] SQL injection via improper identifier quoting
SQL injection via improper identifier quoting. Red Hat rates this important (CVSS 7.7). Weakness: CWE-89. Red Hat lists fixing advisory RHSA-2026:84689 with package mariadb11-8-main-11.8.9-0.1.hum1, mariadb10-11-main-10.11.18-4.1.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenStack Platform 13 (Queens); Red Hat package: mariadb10.11; Red Hat package: mariadb11.8.
High [CVE-2026-85746] Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections
Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:88864 with package mariadb10-11-main-10.11.18-4.1.2.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenStack Platform 13 (Queens); Red Hat package: mariadb10.11; Red Hat package: mariadb11.8.
High [CVE-2026-92262] Numerous issues caused by historical #mysql50# tablename encoding bypass.
Numerous issues caused by historical #mysql50# tablename encoding bypass. Red Hat rates this important (CVSS 8.8). Weakness: CWE-73. Red Hat lists fixing advisory RHSA-2026:92905 with package mariadb10-11-main-10.11.18-4.1.10.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenStack Platform 13 (Queens); Red Hat package: mariadb10.11; Red Hat package: mariadb11.8.
High [CVE-2026-97380] Privilege escalation via empty password in GRANT PROXY statement
Privilege escalation via empty password in GRANT PROXY statement. Red Hat rates this important (CVSS 8.8). Weakness: CWE-266. Red Hat lists fixing advisory RHSA-2026:84689 with package mariadb11-8-main-11.8.9-0.1.hum1, mariadb10-11-main-10.11.18-4.1.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenStack Platform 13 (Queens); Red Hat package: mariadb10.11; Red Hat package: mariadb11.8.
High [CVE-2026-111382] Arbitrary code execution via crafted display frames
Arbitrary code execution via crafted display frames. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: freerdp.
High [CVE-2026-111381] Arbitrary code execution via crafted persistent cache file
Arbitrary code execution via crafted persistent cache file. Red Hat rates this important (CVSS 7.8). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: freerdp.