Red Hat Linux Security Advisories & CVEs
4426 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-93355] Privilege escalation via unverified email lookup in JWT authentication
Privilege escalation via unverified email lookup in JWT authentication. Red Hat rates this important (CVSS 8.1). Weakness: CWE-290. Affected products named by the advisory: Lightspeed Core; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-102010] Denial of Service via use-after-free in binary heap erase_if
Denial of Service via use-after-free in binary heap erase_if. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:74569 with package gcc-main-16.2.1-3.hum1, gcc13-main-13.5.0-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 13 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: gcc-toolset-15-gcc; and 9 more.
High [CVE-2026-97023] CVE-2026-97023
CVE-2026-97023. Red Hat rates this important (CVSS 7.1). Weakness: CWE-61. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: flatpak.
High [CVE-2026-101909] Denial of Service via prototype pollution gadget in form serialization
Denial of Service via prototype pollution gadget in form serialization. Red Hat rates this important (CVSS 8.2). Weakness: CWE-915. Red Hat lists fixing advisory RHSA-2026:74872 with package grafana12-4-main-12.4.12-0.3.hum1, grafana13-1-main-13.1.6-0.6.hum1, grafana13-2-main-13.2.1-0.9.hum1. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-101906] Denial of Service via crafted redirect hostname
Denial of Service via crafted redirect hostname. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1333. Red Hat lists fixing advisory RHSA-2026:74872 with package grafana12-4-main-12.4.12-0.3.hum1, grafana13-1-main-13.1.6-0.6.hum1, grafana13-2-main-13.2.1-0.9.hum1. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-101905] Request socket hijacking via inherited createConnection property
Request socket hijacking via inherited createConnection property. Red Hat rates this important (CVSS 7.4). Weakness: CWE-941. Red Hat lists fixing advisory RHSA-2026:74872 with package grafana12-4-main-12.4.12-0.3.hum1, grafana13-1-main-13.1.6-0.6.hum1, grafana13-2-main-13.2.1-0.9.hum1. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-101903] Denial of Service via malformed data URLs
Denial of Service via malformed data URLs. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1333. Red Hat lists fixing advisory RHSA-2026:74872 with package grafana12-4-main-12.4.12-0.3.hum1, grafana13-1-main-13.1.6-0.6.hum1, grafana13-2-main-13.2.1-0.9.hum1. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-101901] Denial of Service via unhandled error in HTTP/2 session initialization
Denial of Service via unhandled error in HTTP/2 session initialization. Red Hat rates this important (CVSS 7.5). Weakness: CWE-248. Red Hat lists fixing advisory RHSA-2026:74872 with package grafana12-4-main-12.4.12-0.3.hum1, grafana13-1-main-13.1.6-0.6.hum1, grafana13-2-main-13.2.1-0.9.hum1. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-87114] container:// reference extraction runs the image entrypoint and silently escalates to sudo
container:// reference extraction runs the image entrypoint and silently escalates to sudo. Red Hat rates this important (CVSS 7.1). Weakness: CWE-829. Affected product named by the advisory: Pen Drive Powered by Red Hat Lightspeed.
High [CVE-2026-85644] Denial of Service via improper array reference validation
Denial of Service via improper array reference validation. Red Hat rates this important (CVSS 7.5). Weakness: CWE-843. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: perl-xs-parse-keyword.
High [CVE-2026-88815] Denial of Service via invalid memory read during numeric type casting
Denial of Service via invalid memory read during numeric type casting. Red Hat rates this important (CVSS 7.5). Weakness: CWE-843. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: perl-dbi.
High [CVE-2026-93348] Arbitrary code execution via crafted model configuration
Arbitrary code execution via crafted model configuration. Red Hat rates this important (CVSS 8.8). Weakness: CWE-94. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
High [CVE-2026-101292] Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader. Static initializers () and no-argument constructors (()) execute as side effects before the type cast, enabling denial of service via system-property poisoning, out-of-memory conditions via classloading, or broker state manipulation. Combined Severity Note: On JBoss EAP 7.4 versions where CVE-2026-27446 is unpatched, the reflection is reachable pre-authentication (PR:N), resulting in a combined CVSS of 8.2 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). JBoss EAP 7.4 is fixed in EAP 7.4.25 via RHSA-2026:53644, which includes the eap7-activemq-artemis 2.16.0-22.redhat_00057 build. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-470. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform 7.4.25; Red Hat JBoss Enterprise Application Platform 7. Red Hat lists Red Hat AMQ Broker 7 as not affected.
High [CVE-2026-86330] OS command injection in cluster_internal_api.set_hostname_internal
OS command injection in cluster_internal_api.set_hostname_internal. Red Hat rates this important (CVSS 7.2). Weakness: CWE-78. Affected product named by the advisory: Red Hat Openshift Data Foundation 4.
High [CVE-2026-91006] org.apache.karaf.instance/org.apache.karaf.instance.core: karaf: Apache Karaf: Arbitrary command execution via unquoted instance options
org.apache.karaf.instance/org.apache.karaf.instance.core: karaf: Apache Karaf: Arbitrary command execution via unquoted instance options. Red Hat rates this important (CVSS 8.8). Weakness: CWE-78.
High [CVE-2026-94286] Denial of Service via out-of-bounds read in RECORD reply parser
Denial of Service via out-of-bounds read in RECORD reply parser. Red Hat rates this important (CVSS 7.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: libxtst.
High [CVE-2026-101015] DMARC policy bypass via Unicode dot character equivalence in policy.c Domain Handler
DMARC policy bypass via Unicode dot character equivalence in policy.c Domain Handler. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1289.
High [CVE-2026-101014] Denial of Service via off-by-one error in opendmarc_util_cleanup
Denial of Service via off-by-one error in opendmarc_util_cleanup. Red Hat rates this important (CVSS 7.5). Weakness: CWE-193.
High [CVE-2026-74246] Local file inclusion via file:// scheme in Quay custom build trigger
Local file inclusion via file:// scheme in Quay custom build trigger. Red Hat rates this important (CVSS 7.7). Weakness: CWE-918.
High [CVE-2026-96280] Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems. Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The malicious stream is served over the network (AV:N), and the attacker needs only control over the OCI registry content (PR:N). This overflow only manifests on 32-bit targets — on 64-bit systems gsize and guint64 are the same width and truncation does not occur, so exploitability depends on a target configuration outside the attacker's control (AC:H). Meaningful user interaction is required (UI:R). The vulnerable and impacted components remain within the same flatpak client/helper security authority (S:U). Because this is a heap buffer overflow with a stated path to code execution in the Flatpak client process, a successful exploit is treated as a full compromise of that process's privileges (C:H/I:H/A:H). Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-197.