Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2718 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 52 critical, 951 high, 1442 medium, 271 low.
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-109597] Stored cross-site scripting via crafted heading identifiers
Stored cross-site scripting via crafted heading identifiers. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:80677 with package hugo-main-0.167.0-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat OpenShift GitOps; Red Hat OpenStack Platform 18.0; and 1 more. Affected products named by the advisory: Red Hat package: grafana.
Medium [CVE-2026-109574] Information disclosure via Sass import path traversal
Information disclosure via Sass import path traversal. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:80677 with package hugo-main-0.167.0-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat OpenShift GitOps; Red Hat OpenStack Platform 18.0; and 1 more. Affected products named by the advisory: Red Hat package: grafana.
Medium [CVE-2026-109595] Information disclosure via path traversal during asset compilation
Information disclosure via path traversal during asset compilation. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:80677 with package hugo-main-0.167.0-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat OpenShift GitOps; Red Hat OpenStack Platform 18.0; and 1 more. Affected products named by the advisory: Red Hat package: grafana.
Medium [CVE-2026-109379] User enumeration via timing discrepancy
User enumeration via timing discrepancy. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-208. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: cockpit.
Medium [CVE-2026-109448] Denial of Service via integer wraparound in SQLBindParameter
Denial of Service via integer wraparound in SQLBindParameter. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-124. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: postgresql-odbc.
Medium [CVE-2026-109351] Denial of Service via crafted pack-header object count
Denial of Service via crafted pack-header object count. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:83849 with package rust-main-1.99.1-1.1.hum1, rust-main-1.99.0-1.1.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; and 2 more. Affected products named by the advisory: Red Hat package: igvm; Red Hat package: rust.
Medium [CVE-2026-109350] Denial of Service via malformed packfile delta entries
Denial of Service via malformed packfile delta entries. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1285. Red Hat lists fixing advisory RHSA-2026:83849 with package rust-main-1.99.1-1.1.hum1, rust-main-1.99.0-1.1.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; and 2 more. Affected products named by the advisory: Red Hat package: igvm; Red Hat package: rust.
Medium [CVE-2026-109349] Denial of Service via crafted pack header
Denial of Service via crafted pack header. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-617. Red Hat lists fixing advisory RHSA-2026:83849 with package rust-main-1.99.1-1.1.hum1, rust-main-1.99.0-1.1.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; and 2 more. Affected products named by the advisory: Red Hat package: igvm; Red Hat package: rust.
Medium [CVE-2026-109276] Denial of Service via temporary file leak in JNG decoder
Denial of Service via temporary file leak in JNG decoder. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-459. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat package: imagemagick.
Medium [CVE-2026-109275] Code injection via crafted MVG file
Code injection via crafted MVG file. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-94. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat package: imagemagick.
Medium [CVE-2026-109269] Information disclosure via crafted JPEG file
Information disclosure via crafted JPEG file. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-908. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat package: imagemagick.
Medium [CVE-2026-109262] Denial of Service via memory leak in SVG encoder
Denial of Service via memory leak in SVG encoder. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-772. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat package: imagemagick.
Medium [CVE-2026-109259] Information disclosure via crafted TGA image
Information disclosure via crafted TGA image. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-908. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat package: imagemagick.
Medium [CVE-2026-109257] Denial of Service via double-free in NSCodec
Denial of Service via double-free in NSCodec. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-1341. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: freerdp.
Medium [CVE-2026-109256] Denial of Service via heap buffer overflow during clipboard image conversion
Denial of Service via heap buffer overflow during clipboard image conversion. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109255] Arbitrary code execution via integer truncation in license stream validation
Arbitrary code execution via integer truncation in license stream validation. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109254] Denial of Service via use-after-free during audio channel disconnect
Denial of Service via use-after-free during audio channel disconnect. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: freerdp.
Medium [CVE-2026-109253] Denial of Service via out-of-bounds read in RDPEAR
Denial of Service via out-of-bounds read in RDPEAR. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109252] Denial of Service via truncated authentication data
Denial of Service via truncated authentication data. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
Medium [CVE-2026-109251] Denial of Service via invalid video geometry coordinates
Denial of Service via invalid video geometry coordinates. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: freerdp.