Red Hat Linux Security Advisories & CVEs
5187 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-100693] Security restriction bypass via mixed-case URL schemes
Security restriction bypass via mixed-case URL schemes. Red Hat rates this moderate (CVSS 4). Weakness: CWE-918. Red Hat lists fixing advisory RHSA-2026:66266 with package hugo-main-0.166.0-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-100691] Stored cross-site scripting via unescaped lineAnchors option
Stored cross-site scripting via unescaped lineAnchors option. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:66266 with package hugo-main-0.166.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat OpenShift GitOps; Red Hat OpenStack Platform 18.0; and 1 more. Affected products named by the advisory: Red Hat package: grafana.
Medium [CVE-2026-100692] Information disclosure via symlinked mount roots
Information disclosure via symlinked mount roots. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:66266 with package hugo-main-0.166.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat package: grafana.
Medium [CVE-2026-100690] Arbitrary file read via symbolic link sandbox escape
Arbitrary file read via symbolic link sandbox escape. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:74609 with package hugo-main-0.166.0-0.1.hum1, cluster-observability-operator/korrel8r-rhel9:1790854490. Affected products named by the advisory: Cluster Observability Operator 1.5.3; Red Hat Hardened Images; Red Hat OpenShift GitOps.
Medium [CVE-2026-100689] Directory traversal via untrusted submodule path
Directory traversal via untrusted submodule path. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-22. Affected products named by the advisory: Exploit Intelligence; Migration Toolkit for Applications 8; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; and 6 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat OpenStack Platform 13 (Queens); Red Hat OpenStack Platform 16.2; and 2 more.
Medium [CVE-2026-100659] Access control bypass via conflicting request headers
Access control bypass via conflicting request headers. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-444. Affected products named by the advisory: Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Dev Spaces.
Medium [CVE-2026-100658] Denial of Service via unbounded queue in WebSocketServerExtensionHandler
Denial of Service via unbounded queue in WebSocketServerExtensionHandler. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Affected products named by the advisory: Exploit Intelligence; OpenShift Serverless; Red Hat AMQ Broker 7; Red Hat AMQ Clients; and 16 more. Affected products named by the advisory: Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; and 12 more.
Medium [CVE-2026-100654] Denial of Service via out-of-range stop token identifiers
Denial of Service via out-of-range stop token identifiers. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-617. Affected products named by the advisory: Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-100653] Supply chain integrity compromise via incomplete model revision pinning
Supply chain integrity compromise via incomplete model revision pinning. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-494. Affected products named by the advisory: Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-100651] Denial of Service via overlong multimodal inference requests
Denial of Service via overlong multimodal inference requests. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-120. Affected products named by the advisory: Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-100648] Denial of Service via oversized audio decoding
Denial of Service via oversized audio decoding. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Affected products named by the advisory: Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-100647] Denial of Service via unbounded cache_salt parameter
Denial of Service via unbounded cache_salt parameter. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-1322. Affected products named by the advisory: Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-100629] Capgo backend: Unauthorized role modification via improper role binding validation
Capgo backend: Unauthorized role modification via improper role binding validation. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-267. Affected products named by the advisory: Multicluster Engine for Kubernetes; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-98163] Avoid iteration of dying tasks with zero refcount
Avoid iteration of dying tasks with zero refcount. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-366.
Medium [CVE-2026-92842] Information disclosure via out-of-bounds read in stream filters
Information disclosure via out-of-bounds read in stream filters. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: php8.4.
Medium [CVE-2026-91768] Access control bypass via partial IPv6 address comparison
Access control bypass via partial IPv6 address comparison. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-940. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: php8.4.
Medium [CVE-2026-91769] Server impersonation via Common Name fallback in TLS verification
Server impersonation via Common Name fallback in TLS verification. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-295. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: php8.4.
Medium [CVE-2026-91767] Information disclosure via crafted TLS server certificate
Information disclosure via crafted TLS server certificate. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: php8.4.
Medium [CVE-2026-91766] Credential disclosure via cross-origin HTTP redirects
Credential disclosure via cross-origin HTTP redirects. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: php8.4.
Medium [CVE-2025-14181] Denial of Service via heap buffer overflow in SOAP client
Denial of Service via heap buffer overflow in SOAP client. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:70720 with package php-main-8.5.11-2.hum1. Affected product named by the advisory: Red Hat Hardened Images.