Red Hat Linux Security Advisories & CVEs
5442 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Linux release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Linux advisories
Medium [CVE-2026-8926] Information disclosure via incorrect.netrc password lookup
Information disclosure via incorrect.netrc password lookup. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-289. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
Medium [CVE-2026-8924] Cookie injection via malicious HTTP server using super cookies
Cookie injection via malicious HTTP server using super cookies. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-565. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
Medium [CVE-2026-11856] Information disclosure via incorrect Digest authentication header reuse
Information disclosure via incorrect Digest authentication header reuse. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
Medium [CVE-2026-11564] Certificate validation bypass due to incorrect connection reuse
Certificate validation bypass due to incorrect connection reuse. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-295. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
Medium [CVE-2026-10536] Use-after-free vulnerability leading to Denial of Service
Use-after-free vulnerability leading to Denial of Service. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-825.
High [CVE-2026-58467] Arbitrary file read and code execution via path traversal
Arbitrary file read and code execution via path traversal. Red Hat rates this important (CVSS 7.5). Weakness: CWE-22.
High [CVE-2026-55952] Denial of Service in TLS 1.3 session ticket handling
Denial of Service in TLS 1.3 session ticket handling. Red Hat rates this important (CVSS 7.5). Weakness: CWE-130.
High [CVE-2026-11946] Denial of Service via unvalidated endpoint URL length
Denial of Service via unvalidated endpoint URL length. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1284.
High [CVE-2026-9563] Denial of Service via uncontrolled resource consumption in JSON parsing
Denial of Service via uncontrolled resource consumption in JSON parsing. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770.
High [CVE-2026-8147] Unauthorized access to trace data due to missing authorization validation
Unauthorized access to trace data due to missing authorization validation. Red Hat rates this important (CVSS 8.1). Weakness: CWE-425.
High [CVE-2026-53357] fix UAF in l2cap_sock_cleanup_listen vs l2cap_conn_del
fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del(). Red Hat rates this moderate (CVSS 7). Weakness: CWE-366.
Medium [CVE-2026-50149] JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration
JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-295.
Medium [CVE-2026-54886] Erlang OTP ssh: Denial of Service via infinite loop in SFTP channel
Erlang OTP ssh: Denial of Service via infinite loop in SFTP channel. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-835.
Medium [CVE-2026-53422] Erlang OTP ssh: Information disclosure via SFTP REALPATH handler
Erlang OTP ssh: Information disclosure via SFTP REALPATH handler. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-204. Red Hat lists fixing advisory RHSA-2026:35998 with package erlang27-main-27.3.4.14-1.hum1.
Medium [CVE-2026-54431] DPoP verifier accepts malformed proof with private key material
DPoP verifier accepts malformed proof with private key material. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-358.
Medium [CVE-2026-54430] Server-Side Request Forgery allows unauthorized internal network access
Server-Side Request Forgery allows unauthorized internal network access. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-918.
Medium [CVE-2026-38969] Request smuggling via re-parsing of Content-Length header
Request smuggling via re-parsing of Content-Length header. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-444. Red Hat lists fixing advisory RHSA-2026:34975 with package rust-main-1.96.1-1.hum1.
Medium [CVE-2026-53358] use chan timer to close channels in cleanup_listen
use chan timer to close channels in cleanup_listen(). Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-413.
Low [CVE-2026-54891] Unauthenticated data injection during TLS handshake
Unauthenticated data injection during TLS handshake. Red Hat rates this low (CVSS 3.7). Weakness: CWE-924.
Critical [CVE-2026-58517] Authentication bypass due to improper input neutralization
Authentication bypass due to improper input neutralization. Red Hat rates this critical (CVSS 9.1). Weakness: CWE-140.