Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2599 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 52 critical, 907 high, 1369 medium, 269 low.
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-112300] Denial of Service via inefficient regular expression evaluation
Denial of Service via inefficient regular expression evaluation. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-1333. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: python-configobj.
Medium [CVE-2026-111757] Information disclosure via malformed percent-encoded paths in serveStatic
Information disclosure via malformed percent-encoded paths in serveStatic. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-551. Red Hat lists fixing advisory RHSA-2026:85295 with package grafana13-1-main-13.1.7-0.2.hum1, grafana12-4-main-12.4.13-0.1.hum1, grafana13-2-main-13.2.4-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat OpenShift AI (RHOAI); and 2 more. Affected products named by the advisory: Red Hat OpenShift Dev Spaces; Red Hat package: grafana.
Medium [CVE-2026-112282] Denial of Service via out-of-bounds read in clpi_access_point
Denial of Service via out-of-bounds read in clpi_access_point(). Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat package: libbluray.
Medium [CVE-2026-112283] Denial of Service via uncontrolled memory allocation in clpi_parse
Denial of Service via uncontrolled memory allocation in clpi_parse. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat package: libbluray.
Medium [CVE-2026-112278] Denial of Service via heap out-of-bounds read in process_raw_bmpcache
Denial of Service via heap out-of-bounds read in process_raw_bmpcache. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat package: rdesktop.
Medium [CVE-2026-112279] Denial of Service via crafted bitmap cache orders
Denial of Service via crafted bitmap cache orders. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat package: rdesktop.
Medium [CVE-2026-112277] Denial of Service via malformed compressed bitmaps
Denial of Service via malformed compressed bitmaps. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat package: rdesktop.
Medium [CVE-2026-112276] Denial of Service via out-of-bounds read in rasttopnm
Denial of Service via out-of-bounds read in rasttopnm. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: netpbm.
Medium [CVE-2026-112275] Denial of Service via heap-based buffer overflow in rasttopnm
Denial of Service via heap-based buffer overflow in rasttopnm. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: netpbm.
Medium [CVE-2026-112271] Denial of Service via out-of-bounds read in DisplayID parser
Denial of Service via out-of-bounds read in DisplayID parser. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: libdisplay-info.
Medium [CVE-2026-8168] Denial of Service via deeply nested SVG elements
Denial of Service via deeply nested SVG elements. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:58460 with package qt6-qtsvg-main-6.11.2-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: qt6-qtsvg; Red Hat package: qt5-qtsvg.
Medium [CVE-2026-112027] light0011 cms: Information disclosure via filename manipulation in Uploadify
light0011 cms: Information disclosure via filename manipulation in Uploadify. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: goose; Red Hat package: virt-firmware-rs.
Medium [CVE-2026-112057] Denial of Service via crafted disc image
Denial of Service via crafted disc image. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: libdvdnav.
Medium [CVE-2026-112058] Denial of Service via out-of-bounds read in set_PTT
Denial of Service via out-of-bounds read in set_PTT. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: libdvdnav.
Medium [CVE-2026-112008] Denial of Service via heap-based buffer overflow in mng_read_ordr
Denial of Service via heap-based buffer overflow in mng_read_ordr(). Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: libmng.
Low [CVE-2026-112026] light0011 cms: Information disclosure via weak password hashing
light0011 cms: Information disclosure via weak password hashing. Red Hat rates this low (CVSS 3.7). Weakness: CWE-916. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: goose; Red Hat package: virt-firmware-rs.
High [CVE-2026-111881] Denial of Service via crafted clipboard bitmap image
Denial of Service via crafted clipboard bitmap image. Red Hat rates this important (CVSS 7.6). Weakness: CWE-191. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
High [CVE-2026-110752] Denial of Service via excessive memory allocation in fragment selector
Denial of Service via excessive memory allocation in fragment selector. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 9; Red Hat package: perl-text-csv_xs.
High [CVE-2026-62439] Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash. Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: gimp.
High [CVE-2026-68498] Denial of Service via excessively long JSON property names
Denial of Service via excessively long JSON property names. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:88156 with package ocp-tools-4/jenkins-rhel8:1792044386, ocp-tools-4/jenkins-rhel9:1792040096, ocp-tools-4/jenkins-rhel9:1792040287, ocp-tools-4/jenkins-rhel9:1792040131. Affected products named by the advisory: Exploit Intelligence; OpenShift Developer Tools and Services; OpenShift Serverless; Red Hat AI Inference Server; and 20 more. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat Ansible Automation Platform 2; Red Hat build of Apache Camel for Spring Boot 4; Red Hat build of Apache Camel - HawtIO 4; and 16 more.