Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2718 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 52 critical, 951 high, 1442 medium, 271 low.
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-109949] FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard
FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-307. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109947] FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read
FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109946] FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width
FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-617. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109945] FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit
FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-362. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109944] FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle
FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-617. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109942] FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet
FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: freerdp.
Medium [CVE-2026-109940] FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name
FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-121. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109941] FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response
FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-835. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: freerdp.
Medium [CVE-2026-109939] FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order
FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109938] FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update
FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-190. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109680] FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username
FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109679] FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response
FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109677] FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler
FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: freerdp.
Medium [CVE-2026-109748] Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: thunderbird.
Low [CVE-2026-110036] Denial of Service via crafted block indices
Denial of Service via crafted block indices. Red Hat rates this low (CVSS 3.3). Weakness: CWE-190. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: device-mapper-persistent-data.
Low [CVE-2026-110249] Denial-of-service in the Exchange email component
Denial-of-service in the Exchange email component. Red Hat rates this low (CVSS 3.4). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: thunderbird.
High [CVE-2026-103061] Arbitrary directory deletion via path traversal in package metadata
Arbitrary directory deletion via path traversal in package metadata. Red Hat rates this important (CVSS 7.1). Weakness: CWE-22. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat package: mozjs60.
High [CVE-2026-109242] Denial of Service via uninitialized progressive tile handling
Denial of Service via uninitialized progressive tile handling. Red Hat rates this important (CVSS 7.1). Weakness: CWE-908. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: freerdp.
High [CVE-2026-108094] Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process. This issue affects mutter builds that include the vulnerable async ICC creator path (confirmed in 49.x through 50.4). It is fixed upstream in mutter 50.5 and 51.0 via merge request!5313. The maintainer-reported range (>= 47.0, < 51.0) is broader than the code path that carries this bug; 47.x and 48.x do not contain the vulnerable on_icc_create_bytes_read / image_desc_resource lifetime pattern. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-416. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: mutter.
Medium [CVE-2026-109596] Information disclosure via improper link resolution in nested mounts
Information disclosure via improper link resolution in nested mounts. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:80677 with package hugo-main-0.167.0-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat OpenShift GitOps; Red Hat OpenStack Platform 18.0; and 1 more. Affected products named by the advisory: Red Hat package: grafana.