Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
1637 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 33 critical, 619 high, 814 medium, 169 low.
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-102473] Super-polynomial backtracking in pmatch when libc fnmatch is disabled
Super-polynomial backtracking in pmatch when libc fnmatch is disabled. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-1333. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat package: dash.
Medium [CVE-2026-102265] Denial of Service via deeply nested token headers
Denial of Service via deeply nested token headers. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-248. Affected products named by the advisory: Confidential Compute Attestation; Fence Agents Remediation Operator; Lightspeed Core; Migration Toolkit for Applications 8; and 14 more. Affected products named by the advisory: OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Ceph Storage 4; and 10 more.
Medium [CVE-2026-102275] Token verification bypass via mismatched OKP key components
Token verification bypass via mismatched OKP key components. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-347. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Confidential Compute Attestation; Fence Agents Remediation Operator; Lightspeed Core; and 18 more. Affected products named by the advisory: Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; and 14 more.
Medium [CVE-2026-88816] Denial of Service via numeric FetchHashKeyName attribute
Denial of Service via numeric FetchHashKeyName attribute. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-843. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: perl-dbi.
Medium [CVE-2026-94287] Denial of Service via unsigned integer underflow
Denial of Service via unsigned integer underflow. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-191. Red Hat lists fixing advisory RHSA-2026:47072 with package libxpm-main-3.5.19-4.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libxpm.
Medium [CVE-2026-94285] Denial of Service via out-of-bounds read in byte-oriented codeset parser
Denial of Service via out-of-bounds read in byte-oriented codeset parser. Red Hat rates this moderate (CVSS 5.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: libx11.
Medium [CVE-2026-94284] Denial of Service via out-of-bounds read in XIM trigger-key registration parser
Denial of Service via out-of-bounds read in XIM trigger-key registration parser. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: libx11.
Medium [CVE-2026-94283] Denial of Service via out-of-bounds read in XIM attribute parser
Denial of Service via out-of-bounds read in XIM attribute parser. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: libx11.
Medium [CVE-2026-96281] Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes
On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities. Red Hat estimates the CVSSv3.1 vector from the provided vector CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Specific conditions must exist for the attack to occur and user interaction is required. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-284. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: flatpak.
Medium [CVE-2026-96279] Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks
A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow. Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The malicious archive is served over the network (AV:N), and the attacker needs no privileges of their own on the victim system (PR:N). Once the client pulls the crafted layer archive, exploitation is deterministic: Flatpak's OCI extraction rebases archive entry pathnames to the destination directory and enforces ARCHIVE_EXTRACT_SECURE_NODOTDOT to reject.. in pathnames and hardlink targets, but it fails to rebase the hardlink target itself, so a crafted entry with an absolute hardlink target (e.g. /etc/shadow) causes libarchive to hardlink that host file directly into the extraction directory (AC:L). Meaningful user interaction is required (UI:R). On system-wide installs, this extraction runs via the privileged system-helper as root, so the hardlinked file can be an arbitrary root-owned file the attacker has no other means to access. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: flatpak.
Medium [CVE-2026-100702] Denial of Service via deeply nested recipient arrays
Denial of Service via deeply nested recipient arrays. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770. Affected products named by the advisory: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2; Red Hat package: grafana.
Medium [CVE-2026-100701] Information disclosure via TLS servername cache confusion
Information disclosure via TLS servername cache confusion. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-295. Affected products named by the advisory: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2; Red Hat package: grafana.
Medium [CVE-2026-100699] Malformed envelope recipient via crafted email address comments
Malformed envelope recipient via crafted email address comments. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-1286. Affected products named by the advisory: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2; Red Hat package: grafana.
Medium [CVE-2026-100694] Cross-site scripting via unescaped HTML in Org Mode content
Cross-site scripting via unescaped HTML in Org Mode content. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:66266 with package hugo-main-0.166.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat OpenShift GitOps; Red Hat OpenStack Platform 18.0; and 1 more. Affected products named by the advisory: Red Hat package: grafana.
Medium [CVE-2026-100691] Stored cross-site scripting via unescaped lineAnchors option
Stored cross-site scripting via unescaped lineAnchors option. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:66266 with package hugo-main-0.166.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat OpenShift GitOps; Red Hat OpenStack Platform 18.0; and 1 more. Affected products named by the advisory: Red Hat package: grafana.
Medium [CVE-2026-100692] Information disclosure via symlinked mount roots
Information disclosure via symlinked mount roots. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:66266 with package hugo-main-0.166.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat package: grafana.
Medium [CVE-2026-92842] Information disclosure via out-of-bounds read in stream filters
Information disclosure via out-of-bounds read in stream filters. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: php8.4.
Medium [CVE-2026-91768] Access control bypass via partial IPv6 address comparison
Access control bypass via partial IPv6 address comparison. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-940. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: php8.4.
Medium [CVE-2026-91769] Server impersonation via Common Name fallback in TLS verification
Server impersonation via Common Name fallback in TLS verification. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-295. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: php8.4.
Medium [CVE-2026-91767] Information disclosure via crafted TLS server certificate
Information disclosure via crafted TLS server certificate. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: php8.4.