Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2525 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 50 critical, 901 high, 1314 medium, 258 low.
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
High [CVE-2026-116267] Denial of Service via memory exhaustion from deeply nested messages
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from a truncated, deeply nested message. Each stored parser diagnostic is indented by three spaces per nesting level. When a message nested N levels deep ends without its closing boundaries, every level logs an error at its own depth, so the stored diagnostics grow with the square of N. The defaults place no limit on nesting depth. A remote attacker can cause a Denial of Service (DoS) by supplying a truncated, deeply nested message without closing boundaries. Because the parser records indented error messages for each nesting level without enforcing depth limits, processing such input leads to excessive memory consumption and crashes the application. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: perl-mime-tools.
High [CVE-2026-88967] Azure Monitor data source could leak its Azure access token
Azure Monitor data source could leak its Azure access token. Red Hat rates this important (CVSS 7.7). Weakness: CWE-201. Affected products named by the advisory: Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; and 6 more. Affected products named by the advisory: Red Hat Ceph Storage 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more.
High [CVE-2026-103506] SSO secrets readable by low-privileged users when an experimental feature is enabled
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default. A flaw was found in Grafana. When the experimental Kubernetes Single Sign-On (SSO) settings Application Programming Interface (API) feature toggle is enabled, the service fails to enforce proper authorization checks. This vulnerability is rated as an Important impact because authenticated users possessing minimal viewer privileges can expose sensitive single sign-on credentials and modify authentication configurations across the platform. Such credential exposure may allow attackers to compromise downstream identity providers or escalate access within the organization. However, the risk is constrained in standard Red Hat environments because the affected API relies on an experimental feature toggle that remains deactivated by default. Red Hat severity: Important — CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Weakness: CWE-425. Affected products named by the advisory: Red Hat Hardened Images; Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Ceph Storage 7; and 6 more.
Medium [CVE-2026-118251] Cross-site scripting via unvalidated credits link
Cross-site scripting via unvalidated credits link. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; and 1 more. Affected products named by the advisory: Red Hat package: rust.
Medium [CVE-2026-118246] Cross-site scripting via unfiltered breadcrumb style attributes
Cross-site scripting via unfiltered breadcrumb style attributes. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; and 1 more. Affected products named by the advisory: Red Hat package: rust.
Medium [CVE-2026-118244] Cross-site scripting via unsanitized markup fallback during chart redraw
Cross-site scripting via unsanitized markup fallback during chart redraw. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; and 1 more. Affected products named by the advisory: Red Hat package: rust.
Medium [CVE-2026-116272] Security filter bypass via nested comments in boundary parameters
MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment. A parameter written boundary((c))="A" or boundary(\))="A" is stored under that literal name rather than as boundary. A second boundary parameter is then not reported as a duplicate, and MIME::Parser splits the message on it. Readers that skip comments as RFC 5322 allows take the first boundary instead. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it. A flaw was found in perl-mime-tools. A remote attacker can bypass email security filters by sending a specially crafted message containing duplicate Multipurpose Internet Mail Extensions (MIME) boundary parameters with nested comments. Because the parser fails to properly normalize parameter names containing comments, it treats duplicate boundaries as separate entries rather than flagging them as duplicates. This parsing discrepancy allows an attacker to conceal malicious email attachments from security inspection tools while the recipient's email client displays them. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-115. Affected Red Hat products: Red Hat Enterprise Linux 6. Will not fix / out of support: Red Hat Enterprise Linux 6.
Medium [CVE-2026-116271] Arbitrary file overwrite via symbolic link following
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg--- under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link. When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process. A flaw was found in perl-mime-tools. This vulnerability allows a local attacker to overwrite arbitrary files with the permissions of the application process. When the parser writes message attachments into a shared or world-writable directory, an attacker can pre-create the expected output directory containing symbolic links (file shortcuts) targeting sensitive files. Consequently, the parser follows these links when writing attachment data, potentially leading to unauthorized data modification or privilege escalation. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H). Weakness: CWE-59.
Medium [CVE-2026-116269] Attachment filter bypass via improper filename decoding
MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename. A parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter. Other mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename. A flaw was found in MIME-tools. When parsing email attachment filenames that contain hyphenated language tags, the decoder fails to properly process the character set and incorrectly returns an empty filename. A remote attacker can exploit this flaw by sending a specially crafted email message to bypass file extension security controls. As a result, restricted or malicious file attachments may pass undetected through email filtering systems and reach end users. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-115. Affected Red Hat products: Red Hat Enterprise Linux 6. Will not fix / out of support: Red Hat Enterprise Linux 6.
Medium [CVE-2026-116268] Denial of Service via unclosed comments in header parameters
MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in header parameters. The comment pattern used to parse Content-Type and Content-Disposition parameters scans from each "(" to the next ")". In a field with no ")", every "(" scans to the end of the header and fails, so parsing takes time quadratic in the header length. The field is parsed again on each attribute lookup, several times per MIME entity. A 40 KB header takes about 7 seconds to parse once. A flaw was found in perl-MIME-tools. A remote attacker can cause a Denial of Service (DoS) by supplying specially crafted Multipurpose Internet Mail Extensions (MIME) headers containing unclosed comments. Due to inefficient parsing of parameters lacking closing parentheses, the parser repeatedly scans the remainder of the header, leading to excessive CPU consumption and application unresponsiveness. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-1333. Affected Red Hat products: Red Hat Enterprise Linux 6. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: perl-mime-tools.
Medium [CVE-2026-116266] Security filter bypass via partially encoded multipart boundary
MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous. The multipart_boundary() method decodes RFC 2047 encoded words anywhere in the boundary, but the ambiguity check only fires when the whole value is one encoded word. A boundary such as abc=?us-ascii?Q?def?= is used as abcdef, and ambiguous_content() returns false. Encoded words are not allowed in parameters, so other mail readers split the message on the literal value. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it. A flaw was found in perl-mime-tools. When parsing email headers, the library decodes partially encoded boundary values in multipart messages without flagging the content as ambiguous. A remote attacker can exploit this flaw by sending a specially crafted email message to bypass email security filters that inspect attachments, while still allowing the recipient's mail client to display the content. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-115. Affected Red Hat products: Red Hat Enterprise Linux 6. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-116265] Security filter bypass via ambiguous multipart boundary continuations
MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations. The boundary ambiguity checks look only at a plain boundary= parameter, and a boundary split into RFC 2231 sections (boundary*0=, boundary*1= and so on) is joined after they have run. A repeated section number is concatenated rather than reported as a duplicate. From version 5.518, an encoded word or trailing whitespace in such a boundary also goes unflagged, although multipart_boundary() decodes or strips it. A remote sender can make MIME::Parser split a message on a different boundary than other mail readers, hiding an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it. A flaw was found in perl-MIME-tools. A remote attacker can exploit this vulnerability to bypass email security filters by sending an email with specially crafted multipart boundary parameters. Because the parser does not properly validate boundary parameters split across continuations, it processes message parts differently from standard email clients, allowing hidden attachments to evade inspection while still displaying to the recipient. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-179. Affected Red Hat products: Red Hat Enterprise Linux 6.
Medium [CVE-2026-116264] Security filter bypass via invalid Content-Type parameter
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous. Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it. A flaw was found in perl-MIME-tools. This vulnerability allows a remote attacker to bypass email security filters by sending an email with a malformed Content-Type parameter. Because the parser halts processing upon encountering an invalid parameter name, it discards subsequent parameters, including the multipart boundary, without flagging the content as ambiguous. Consequently, security scanners fail to inspect concealed attachments that downstream email clients still render to the recipient. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-1286. Affected Red Hat products: Red Hat Enterprise Linux 6. Will not fix / out of support: Red Hat Enterprise Linux 6.
Medium [CVE-2026-118242] Cross-site scripting via unsanitized grid icon attributes
Cross-site scripting via unsanitized grid icon attributes. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; and 1 more. Affected products named by the advisory: Red Hat package: rust.
Medium [CVE-2026-116797] Cross-site scripting via unsanitized column attributes
Cross-site scripting via unsanitized column attributes. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; and 1 more. Affected products named by the advisory: Red Hat package: rust.
Medium [CVE-2026-116796] Arbitrary script execution via unsanitized SVG link attributes
Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1. A flaw was found in Highcharts. An attacker who can supply chart text configurations can execute arbitrary script in a victim's browser session. The library fails to validate URL schemes on certain Scalable Vector Graphics (SVG) anchor link attributes, allowing malicious JavaScript links to persist into exported chart output. This vulnerability is rated as having Moderate impact for Red Hat environments because successful exploitation requires multiple preconditions, including user interaction and non-default application processing workflows. An attacker cannot execute code directly across the network; instead, malicious input must be accepted into chart configuration fields, rendered or exported as an SVG graphic, and subsequently parsed and clicked by a victim.
Medium [CVE-2026-118384] Denial of Service via out-of-bounds write in VFAT parsing
Denial of Service via out-of-bounds write in VFAT parsing. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: mtools.
Medium [CVE-2026-117608] Denial of Service via integer overflow in MD2 parser
Denial of Service via integer overflow in MD2 parser. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: qt6-qtquick3d; Red Hat package: qt5-qt3d.
Medium [CVE-2026-88858] Math expressions could crash Grafana
Math expressions could crash Grafana. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-770. Affected products named by the advisory: Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; and 6 more. Affected products named by the advisory: Red Hat Ceph Storage 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more.
Low [CVE-2026-118681] Authentication bypass via SuppressNotFound middleware
Authentication bypass via SuppressNotFound middleware. Red Hat rates this low (CVSS 3.7). Weakness: CWE-305. Affected products named by the advisory: Logging Subsystem for Red Hat OpenShift; Multicluster Engine for Kubernetes; OpenShift Pipelines; OpenShift Serverless; and 11 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; and 7 more.