Red Hat Linux RHEL & SELinux Vulnerabilities & Security Advisories
2536 advisories tracked · Red Hat Security Data API · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as RHEL & SELinux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 50 critical, 896 high, 1323 medium, 265 low.
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat RHEL & SELinux advisories
Medium [CVE-2026-106072] Authentication bypass via non-canonical IPv4 hostname verification
Authentication bypass via non-canonical IPv4 hostname verification. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-295. Red Hat lists fixing advisory RHSA-2026:92378 with package nodejs:24-9080020261027142403.rhel9, nodejs:24-8100020261027151919.6d880403. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: nodejs22; and 2 more. Affected products named by the advisory: Red Hat package: nodejs24; Red Hat package: nodejs26.
Medium [CVE-2026-55889] unauthorized data disclosure via predictable token generation
unauthorized data disclosure via predictable token generation. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-338. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: xdg-desktop-portal.
Low [CVE-2026-106071] Permission model bypass via wildcard path matching flaw
Permission model bypass via wildcard path matching flaw. Red Hat rates this low (CVSS 3.6). Weakness: CWE-284. Red Hat lists fixing advisory RHSA-2026:92378 with package nodejs:24-9080020261027142403.rhel9, nodejs:24-8100020261027151919.6d880403. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: nodejs26.
Low [CVE-2026-106070] Security inspection bypass via crafted ZIP archive header mismatch
Security inspection bypass via crafted ZIP archive header mismatch. Red Hat rates this low (CVSS 3.7). Weakness: CWE-754. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: nodejs26.
Low [CVE-2026-106073] Filesystem read permission bypass via fs.realpathSync
Filesystem read permission bypass via fs.realpathSync(). Red Hat rates this low (CVSS 3.3). Weakness: CWE-425. Red Hat lists fixing advisory RHSA-2026:92378 with package nodejs:24-9080020261027142403.rhel9, nodejs:24-8100020261027151919.6d880403. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: nodejs22; and 2 more. Affected products named by the advisory: Red Hat package: nodejs24; Red Hat package: nodejs26.
Critical [CVE-2026-110264] integer overflow issue in regular expression compiler
integer overflow issue in regular expression compiler. Red Hat rates this critical (CVSS 9.8). Weakness: CWE-190. Red Hat lists fixing advisory RHSA-2026:88861 with package ruby3-3-main-3.3.13-23.8.hum1, ruby3-4-main-3.4.12-33.1.hum1, ruby4-0-main-4.0.9-41.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat Satellite 6; Red Hat package: ruby4.0.
High [CVE-2026-114613] Denial of Service via memory leak during map deserialization
Denial of Service via memory leak during map deserialization. Red Hat rates this important (CVSS 7.5). Weakness: CWE-772. Affected products named by the advisory: Lightspeed Services for Advanced Cluster Management; Pen Drive Powered by Red Hat Lightspeed; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; and 14 more. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Lightspeed Services for OCP; and 10 more.
High [CVE-2026-97631] Pre-boot RCE in EDK II PXE driver
Pre-boot RCE in EDK II PXE driver. Red Hat rates this critical (CVSS 8.8). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; and 1 more. Affected products named by the advisory: Red Hat package: edk2.
High [CVE-2026-114605] Denial of Service via excessive DNS compression pointer traversal
Denial of Service via excessive DNS compression pointer traversal. Red Hat rates this important (CVSS 7.5). Weakness: CWE-606. Red Hat lists fixing advisory RHSA-2026:92667 with package satellite/foreman-mcp-server-rhel9:1793272279, satellite/foreman-mcp-server-rhel9:1793272276. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; and 18 more. Affected products named by the advisory: Migration Toolkit for Containers; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; and 14 more.
High [CVE-2026-94482] Denial of Service via crafted requests targeting Server Actions
Denial of Service via crafted requests targeting Server Actions. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 5 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Trusted Artifact Signer; streams for Apache Kafka 3; Red Hat package: firefox; and 1 more.
High [CVE-2026-92709] Path traversal via unsanitized dynaFile templates
Path traversal via unsanitized dynaFile templates. Red Hat rates this important (CVSS 8.1). Weakness: CWE-22. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: rsyslog7.
Medium [CVE-2026-115391] Denial of Service via unbounded buffering in WASIp3 write streams
Denial of Service via unbounded buffering in WASIp3 write streams. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-770. Affected products named by the advisory: Red Hat Connectivity Link 1; Red Hat Enterprise Linux 10; Red Hat package: tree-sitter; Red Hat package: virt-firmware-rs.
Medium [CVE-2026-115390] Denial of Service via fuel accounting flaw
Denial of Service via fuel accounting flaw. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-770. Affected products named by the advisory: Red Hat Connectivity Link 1; Red Hat Enterprise Linux 10; Red Hat package: tree-sitter; Red Hat package: virt-firmware-rs.
Medium [CVE-2026-115383] Denial of Service via improper validation of WebAssembly tag imports
Denial of Service via improper validation of WebAssembly tag imports. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-843. Affected products named by the advisory: Red Hat Connectivity Link 1; Red Hat Enterprise Linux 10; Red Hat package: tree-sitter; Red Hat package: virt-firmware-rs.
Medium [CVE-2026-115382] Denial of Service via zero timeout in HTTP request option
Denial of Service via zero timeout in HTTP request option. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-248. Affected products named by the advisory: Red Hat Connectivity Link 1; Red Hat Enterprise Linux 10; Red Hat package: tree-sitter; Red Hat package: virt-firmware-rs.
Medium [CVE-2026-115379] Denial of Service via missing garbage collection rooting
Denial of Service via missing garbage collection rooting. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-825. Affected products named by the advisory: Red Hat Connectivity Link 1; Red Hat Enterprise Linux 10; Red Hat package: tree-sitter; Red Hat package: virt-firmware-rs.
Medium [CVE-2026-115327] Denial of Service via crafted NETCONF RPC action envelope
Denial of Service via crafted NETCONF RPC action envelope. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-824. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: libyang.
Low [CVE-2026-115393] Memory corruption via cross-engine object validation failure
Memory corruption via cross-engine object validation failure. Red Hat rates this low (CVSS 3.8). Weakness: CWE-843. Affected products named by the advisory: Red Hat Connectivity Link 1; Red Hat Enterprise Linux 10; Red Hat package: tree-sitter; Red Hat package: virt-firmware-rs.
Low [CVE-2026-115389] Denial of Service via untracked host memory allocation in Val API
Denial of Service via untracked host memory allocation in Val API. Red Hat rates this low (CVSS 2.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Connectivity Link 1; Red Hat Enterprise Linux 10; Red Hat package: tree-sitter; Red Hat package: virt-firmware-rs.
Low [CVE-2026-115386] Information disclosure via uninitialized struct padding in fd_readdir
Information disclosure via uninitialized struct padding in fd_readdir. Red Hat rates this low (CVSS 3.3). Weakness: CWE-908. Affected products named by the advisory: Red Hat Connectivity Link 1; Red Hat Enterprise Linux 10; Red Hat package: tree-sitter; Red Hat package: virt-firmware-rs.