Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2718 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 52 critical, 951 high, 1442 medium, 271 low.
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-110832] Denial of Service via memory exhaustion in dynamic virtual channels
Denial of Service via memory exhaustion in dynamic virtual channels. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-400. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: freerdp.
Medium [CVE-2026-110831] Denial of Service via file handle leak during drive redirection
Denial of Service via file handle leak during drive redirection. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-775. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-110829] Denial of Service via malformed rdpsnd channel fragment
Denial of Service via malformed rdpsnd channel fragment. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-110772] Unauthorized transaction modification via bulk update missing authorization
Unauthorized transaction modification via bulk update missing authorization. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-639. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4; Red Hat package: python-sure.
Medium [CVE-2026-110602] Memory corruption via uninitialized pointer free in kwajd_open
Memory corruption via uninitialized pointer free in kwajd_open. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-763. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat package: libmspack.
Medium [CVE-2026-86414] leaking host credentials to HTTP proxy
leaking host credentials to HTTP proxy. Red Hat rates this low (CVSS 6.5). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 6 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat JBoss Core Services; Red Hat Satellite 6; and 2 more.
Medium [CVE-2026-92388] FTP wildcard write callback mixup
FTP wildcard write callback mixup. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-416. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 5 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat JBoss Core Services; Red Hat Satellite 6; Red Hat package: curl; and 1 more.
Medium [CVE-2026-86410] redirect to SFTP or SCP bypasses host verification
redirect to SFTP or SCP bypasses host verification. Red Hat rates this low (CVSS 6.8). Weakness: CWE-297. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat package: curl.
Medium [CVE-2026-86409] stale SigV4 headers sent unintended
stale SigV4 headers sent unintended. Red Hat rates this low (CVSS 5.3). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat JBoss Core Services; and 3 more. Affected products named by the advisory: Red Hat Satellite 6; Red Hat package: curl; Red Hat package: snphost.
Medium [CVE-2026-92386] server-set cookie aborts cookie jar load
server-set cookie aborts cookie jar load. Red Hat rates this low (CVSS 4.3). Weakness: CWE-1284. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat JBoss Core Services; Red Hat Satellite 6; and 1 more. Affected products named by the advisory: Red Hat package: curl.
Medium [CVE-2026-92390] -J no-clobber guarantee bypassed with 103 early hints
- J no-clobber guarantee bypassed with 103 early hints. Red Hat rates this low (CVSS 6.5). Weakness: CWE-73. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat JBoss Core Services; Red Hat Satellite 6; Red Hat package: curl.
Medium [CVE-2026-100229] out-of-bounds write in gst_h266_parser_parse_dci due to off-by-one array bound check
out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check. Red Hat rates this low (CVSS 6.5). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: gstreamer1-plugins-bad-free.
Low [CVE-2026-87862] HSTS cache import drops longer-lived child
HSTS cache import drops longer-lived child. Red Hat rates this low (CVSS 3.7). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat JBoss Core Services; Red Hat Satellite 6; and 1 more. Affected products named by the advisory: Red Hat package: curl.
Low [CVE-2026-87863] Hsts Response Erases Persisted Entries
Hsts Response Erases Persisted Entries. Red Hat rates this low (CVSS 3.7). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat JBoss Core Services; and 3 more. Affected products named by the advisory: Red Hat Satellite 6; Red Hat package: curl; Red Hat package: snphost.
Low [CVE-2026-87864] IMAP APPEND plus CRLF conversion command injection
IMAP APPEND plus CRLF conversion command injection. Red Hat rates this low (CVSS 3.7). Weakness: CWE-130. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat Satellite 6; Red Hat package: curl.
Low [CVE-2026-92387] never-ending loop via server response omission
never-ending loop via server response omission. Red Hat rates this low (CVSS 3.7). Weakness: CWE-835. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat JBoss Core Services; Red Hat Satellite 6; and 1 more. Affected products named by the advisory: Red Hat package: curl.
Low [CVE-2026-92389] TFTP direction confusion
TFTP direction confusion. Red Hat rates this low (CVSS 3.7). Weakness: CWE-200. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Satellite 6; Red Hat package: curl.
Low [CVE-2026-92391] curl_mime_free stack overflow by recursion
curl_mime_free stack overflow by recursion. Red Hat rates this low (CVSS 3.7). Weakness: CWE-674. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more. Affected products named by the advisory: Red Hat JBoss Core Services; Red Hat Satellite 6; Red Hat package: curl; Red Hat package: snphost.
Low [CVE-2026-94266] password leak in CURLINFO_EFFECTIVE_URL
password leak in CURLINFO_EFFECTIVE_URL. Red Hat rates this low (CVSS 3.3). Weakness: CWE-522. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat JBoss Core Services; and 3 more. Affected products named by the advisory: Red Hat Satellite 6; Red Hat package: curl; Red Hat package: snphost.
Low [CVE-2026-107929] local interface connection reuse mixup
local interface connection reuse mixup. Red Hat rates this low (CVSS 3.7). Weakness: CWE-488. Red Hat lists fixing advisory RHSA-2026:82895 with package curl-main-8.23.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat JBoss Core Services; Red Hat Satellite 6; and 1 more. Affected products named by the advisory: Red Hat package: curl.