Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
1640 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 34 critical, 621 high, 814 medium, 169 low.
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-44235] Denial of Service via AMQP frame length underflow
Denial of Service via AMQP frame length underflow. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: librabbitmq.
Medium [CVE-2026-8674] glibc DNS stub resolver: Denial of Service via long search domain in configuration
glibc DNS stub resolver: Denial of Service via long search domain in configuration. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-1025. Red Hat lists fixing advisory RHSA-2026:69276 with package glibc-main-2.43-8.6.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat package: glibc.
Medium [CVE-2026-76781] Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS). This Moderate flaw in libxml2's XML catalog parsing can lead to a denial of service. The vulnerability requires user interaction, as a specially crafted XML catalog with a missing `catalog` attribute in a `nextCatalog` element must be processed by an application using libxml2, causing it to crash. This limits the attack surface to scenarios where an attacker can provide malicious XML input to a vulnerable application. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Hardened Images as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2026:57604. Affected products named by the advisory: Red Hat package: libxml2; Red Hat package: podman.
Medium [CVE-2026-92382] unbounded iso_packet_desc index in usbredirhost_iso_packet leads to heap out-of-bounds write
unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write. Red Hat rates this moderate (CVSS 4.1). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: usbredir.
Medium [CVE-2026-92595] Information disclosure and SSRF via sandbox bypass in resolveContent
Information disclosure and SSRF via sandbox bypass in resolveContent. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-918. Affected products named by the advisory: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2; Red Hat package: grafana.
Medium [CVE-2026-64684] Sensitive HTTP headers leaked during cross-origin redirects
Sensitive HTTP headers leaked during cross-origin redirects. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-212. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: goose.
Medium [CVE-2026-81871] go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-295. Red Hat lists fixing advisory RHSA-2026:74865 with package distribution-main-3.1.1-0.2.hum1, helm4-main-4.3.0-0.2.hum1, caddy-main-2.11.4-0.4.hum1, helm3-main-3.22.0-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Assisted Installer for Red Hat OpenShift Container Platform 2; Logging Subsystem for Red Hat OpenShift; Multiarch Tuning Operator; and 22 more. Affected products named by the advisory: Multicluster Engine for Kubernetes; Multicluster Global Hub; OpenShift Developer Tools and Services; OpenShift Lightspeed; and 18 more.
Medium [CVE-2026-81872] Denial of Service via attacker-driven log emission
Denial of Service via attacker-driven log emission. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-835. Red Hat lists fixing advisory RHSA-2026:68778 with package grafana13-2-main-13.2.1-0.5.hum1, opentelemetry-collector-contrib-main-0.161.0-0.1.hum1, opentofu1-12-main-1.12.6-0.3.hum1, distribution-main-3.1.1-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Assisted Installer for Red Hat OpenShift Container Platform 2; Logging Subsystem for Red Hat OpenShift; Multiarch Tuning Operator; and 22 more. Affected products named by the advisory: Multicluster Engine for Kubernetes; Multicluster Global Hub; OpenShift Developer Tools and Services; OpenShift Lightspeed; and 18 more.
Medium [CVE-2026-91103] Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service
Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: hplip.
Medium [CVE-2026-91101] Remote Code Execution and Privilege Escalation Vulnerabilities
Remote Code Execution and Privilege Escalation Vulnerabilities. Red Hat rates this moderate (CVSS 4.6). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: hplip.
Medium [CVE-2026-91100] Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service.
Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. Red Hat rates this moderate (CVSS 6.6). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: hplip.
Medium [CVE-2026-91099] Multiple vulnerabilities enabling local code execution and privilege escalation
Multiple vulnerabilities enabling local code execution and privilege escalation. Red Hat rates this moderate (CVSS 5.1). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: hplip.
Medium [CVE-2026-77119] DNSSEC bypass via NSEC3 insecure-referral proof
DNSSEC bypass via NSEC3 insecure-referral proof. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-290. Red Hat lists fixing advisory RHSA-2026:68279 with package bind-main-9.20.29-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: bind9.16; Red Hat package: bind9.18.
Medium [CVE-2026-75029] Denial of Service via crafted query responses
Denial of Service via crafted query responses. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:68279 with package bind-main-9.20.29-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: bind9.16; Red Hat package: bind9.18.
Medium [CVE-2026-19668] Denial of Service via invalid DNSSEC records
Denial of Service via invalid DNSSEC records. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:68279 with package bind-main-9.20.29-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: bind9.16; Red Hat package: bind9.18.
Medium [CVE-2026-19033] Unauthorized zone content updates via unauthenticated IXFR deltas
Unauthorized zone content updates via unauthenticated IXFR deltas. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-347. Red Hat lists fixing advisory RHSA-2026:68279 with package bind-main-9.20.29-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: bind9.16; Red Hat package: bind9.18.
Medium [CVE-2026-61709] Unauthorized access due to ListUsers API returning deliberately excluded users.
Unauthorized access due to ListUsers API returning deliberately excluded users. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-783. Red Hat lists fixing advisory RHSA-2026:68777 with package grafana13-2-main-13.2.1-0.4.hum1, grafana12-4-main-12.4.10-0.5.hum1, grafana12-4-main-12.4.10-0.6.hum1, grafana13-1-main-13.1.6-0.4.hum1. Affected products named by the advisory: Red Hat Hardened Images; Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Ceph Storage 6; and 5 more. Affected products named by the advisory: Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat Enterprise Linux 10; and 1 more.
Medium [CVE-2026-78301] DNS cache poisoning via malformed zone insertion
DNS cache poisoning via malformed zone insertion. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-168. Red Hat lists fixing advisory RHSA-2026:68279 with package bind-main-9.20.29-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: bind9.16; Red Hat package: bind9.18.
Medium [CVE-2026-19941] DNS wildcard record existence can be masked by an attacker via inapplicable NSEC records
DNS wildcard record existence can be masked by an attacker via inapplicable NSEC records. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-346. Red Hat lists fixing advisory RHSA-2026:68279 with package bind-main-9.20.29-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: bind9.16; Red Hat package: bind9.18.
Medium [CVE-2026-19662] Denial of Service via crafted DNSSEC responses
Denial of Service via crafted DNSSEC responses. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:68279 with package bind-main-9.20.29-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: bind9.16; Red Hat package: bind9.18.