Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2715 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 52 critical, 951 high, 1439 medium, 271 low.
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-111132] Denial of Service via crafted XPS document
Denial of Service via crafted XPS document. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: libgxps.
Medium [CVE-2026-111129] Denial of Service via invalid animation track targets
Denial of Service via invalid animation track targets. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: qt6-qtquick3d; Red Hat package: qt5-qt3d.
Medium [CVE-2026-111128] Denial of Service via NULL pointer dereference in Ogre3D importer
Denial of Service via NULL pointer dereference in Ogre3D importer. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: qt6-qtquick3d; Red Hat package: qt5-qt3d.
Medium [CVE-2026-111125] Denial of Service via heap-based out-of-bounds read in HCOMPRESS tile decoder
Denial of Service via heap-based out-of-bounds read in HCOMPRESS tile decoder. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat package: cfitsio.
Medium [CVE-2026-111124] Denial of Service via out-of-bounds read during image decompression
Denial of Service via out-of-bounds read during image decompression. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat package: cfitsio.
Medium [CVE-2026-87029] Denial of Service via unhandled exception in decompress interceptor
Denial of Service via unhandled exception in decompress interceptor. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-248. Red Hat lists fixing advisory RHSA-2026:84706 with package nodejs24-main-11.19.0-1.24.21.0.1.5.hum1, nodejs26-main-26.11.1-0.4.hum1, rhtas/rhtas-console-ui-rhel9:1793114810, nodejs24-main-24.21.0-1.5.hum1. Affected products named by the advisory: Red Hat Hardened Images; Cryostat 4; Exploit Intelligence; Red Hat AMQ Broker 7; and 17 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Build of Podman Desktop; Red Hat Developer Hub; Red Hat Enterprise Linux 10; and 13 more.
Medium [CVE-2026-109932] Denial of Service via unbounded WebSocket PONG buffering
Denial of Service via unbounded WebSocket PONG buffering. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:84706 with package nodejs24-main-11.19.0-1.24.21.0.1.5.hum1, rhtas/rhtas-console-ui-rhel9:1793114810, nodejs24-main-24.21.0-1.5.hum1, nodejs26-main-11.20.0-1.26.12.1.0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Cryostat 4; Exploit Intelligence; Red Hat AMQ Broker 7; and 17 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Build of Podman Desktop; Red Hat Developer Hub; Red Hat Enterprise Linux 10; and 13 more.
Medium [CVE-2026-109841] Subresource Integrity bypass via non-lowercase algorithm tokens
Subresource Integrity bypass via non-lowercase algorithm tokens. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-354. Red Hat lists fixing advisory RHSA-2026:84706 with package nodejs24-main-11.19.0-1.24.21.0.1.5.hum1, nodejs26-main-26.11.1-0.4.hum1, rhtas/rhtas-console-ui-rhel9:1793114810, nodejs24-main-24.21.0-1.5.hum1. Affected products named by the advisory: Red Hat Hardened Images; Cryostat 4; Exploit Intelligence; Red Hat AMQ Broker 7; and 17 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Build of Podman Desktop; Red Hat Developer Hub; Red Hat Enterprise Linux 10; and 13 more.
Medium [CVE-2026-109924] Denial of Service via memory exhaustion in EventSource client
Denial of Service via memory exhaustion in EventSource client. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:84706 with package nodejs24-main-11.19.0-1.24.21.0.1.5.hum1, rhtas/rhtas-console-ui-rhel9:1793114810, nodejs24-main-24.21.0-1.5.hum1, nodejs26-main-11.20.0-1.26.12.1.0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Cryostat 4; Exploit Intelligence; Red Hat AMQ Broker 7; and 17 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Build of Podman Desktop; Red Hat Developer Hub; Red Hat Enterprise Linux 10; and 13 more.
Medium [CVE-2026-63430] Cross-site scripting via improper MathML namespace handling
Cross-site scripting via improper MathML namespace handling. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-79. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Satellite 6; Red Hat package: rust.
Medium [CVE-2026-79824] Hewlett Packard Enterprise HPE NonStop Python 3.x: directory traversal
Hewlett Packard Enterprise HPE NonStop Python 3.x: directory traversal. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-22. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 8 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images; Red Hat OpenShift Virtualization 4; and 4 more.
Medium [CVE-2026-110925] '$' and '\' in a command-line username expand through %u
'$' and '\' in a command-line username expand through %u. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:82247 with package openssh-main-10.5p1-1.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 8; Red Hat package: openssh.
Medium [CVE-2026-85745] out-of-bounds read in ST_Area with crafted MULTIPOLYGON
out-of-bounds read in ST_Area with crafted MULTIPOLYGON. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:84689 with package mariadb11-8-main-11.8.9-0.1.hum1, mariadb10-11-main-10.11.18-4.1.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat package: mariadb10.11; Red Hat package: mariadb11.8.
High [CVE-2026-92392] HTTP/2 upload Use-After-Free
HTTP/2 upload Use-After-Free. Red Hat rates this important (CVSS 8.1). Weakness: CWE-416. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1, rust-main-1.99.0-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat package: curl.
Medium [CVE-2026-110872] Denial of Service via inefficient SMTP reply parsing
Denial of Service via inefficient SMTP reply parsing. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-1322. Affected products named by the advisory: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2; Red Hat package: grafana.
Medium [CVE-2026-110871] Denial of Service via inefficient header parsing
Denial of Service via inefficient header parsing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1322. Affected products named by the advisory: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2; Red Hat package: grafana.
Medium [CVE-2026-110870] Domain allow-list bypass via improper address comment parsing
Domain allow-list bypass via improper address comment parsing. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-791. Affected products named by the advisory: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2; Red Hat package: grafana.
Medium [CVE-2026-110836] Denial of Service via crafted gateway Content-Type header
Denial of Service via crafted gateway Content-Type header. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-835. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-110835] HTTP header injection via crafted proxy routing token
HTTP header injection via crafted proxy routing token. Red Hat rates this moderate (CVSS 4). Weakness: CWE-93. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-110834] Denial of Service via out-of-lifecycle serial requests
Denial of Service via out-of-lifecycle serial requests. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: freerdp.