Red Hat Linux Security Advisories & CVEs
11611 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-91947] Use-after-free vulnerability in DRDYNVC parser leads to memory corruption
Use-after-free vulnerability in DRDYNVC parser leads to memory corruption. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:75570 with package freerdp-2:3.10.3-12.el10_2.14. Affected product named by the advisory: Red Hat Enterprise Linux 10.
High [CVE-2024-14029] Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding. Red Hat rates this important (CVSS 7.5). Weakness: CWE-444. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat package: python-tornado.
High [CVE-2023-54397] Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
Tornado before 6.3.3 HTTP Request Smuggling via Content-Length. Red Hat rates this critical (CVSS 7.5). Weakness: CWE-444. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat package: python-tornado.
High [CVE-2026-85013] Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters
Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters. Red Hat rates this moderate (CVSS 7.3). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:64766 with package environment-modules-main-5.6.2-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: environment-modules.
High [CVE-2026-54167] github.com/openshift-pipelines/pipelines-as-code: Pipelines-as-Code: GitHub App token redirection via untrusted host header
github.com/openshift-pipelines/pipelines-as-code: Pipelines-as-Code: GitHub App token redirection via untrusted host header. Red Hat rates this important (CVSS 8.2). Weakness: CWE-345. Affected products named by the advisory: Red Hat Web Terminal.
High [CVE-2026-39919] Heap buffer overflow via JPEG 2000 output adapter
Heap buffer overflow via JPEG 2000 output adapter. Red Hat rates this moderate (CVSS 7.8). Weakness: CWE-122. Red Hat lists fixing advisory RHSA-2026:74464 with package ghostscript-0:9.54.0-19.el9_8.1, ghostscript-0:10.02.1-16.el10_2.1. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10.
High [CVE-2026-92038] Mitigation bypass in the Remote Settings Client component
Mitigation bypass in the Remote Settings Client component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-807.
High [CVE-2026-92037] Incorrect boundary conditions in the DOM: Animation component
Incorrect boundary conditions in the DOM: Animation component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787.
High [CVE-2026-92036] Incorrect boundary conditions in the Networking: HTTP component
Incorrect boundary conditions in the Networking: HTTP component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787.
High [CVE-2026-92035] Sandbox escape due to incorrect boundary conditions in the Graphics component
Sandbox escape due to incorrect boundary conditions in the Graphics component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-501.
High [CVE-2026-92034] Site isolation issue in the Graphics component
Site isolation issue in the Graphics component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-653.
High [CVE-2026-92033] Privilege escalation in Firefox for Android
Privilege escalation in Firefox for Android. Red Hat rates this important (CVSS 7.5). Weakness: CWE-266.
High [CVE-2026-92029] Use-after-free in the SVG component
Use-after-free in the SVG component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
High [CVE-2026-92028] Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
High [CVE-2026-92027] Use-after-free in the DOM: Streams component
Use-after-free in the DOM: Streams component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
High [CVE-2026-92026] Use-after-free in the Networking component
Use-after-free in the Networking component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
High [CVE-2026-92025] Use-after-free in the DOM: Navigation component
Use-after-free in the DOM: Navigation component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
High [CVE-2026-92023] Use-after-free in the XML component
Use-after-free in the XML component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
High [CVE-2026-92022] Use-after-free in the DOM: HTML Parser component
Use-after-free in the DOM: HTML Parser component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
High [CVE-2026-92021] Use-after-free in the JavaScript Engine: JIT component
Use-after-free in the JavaScript Engine: JIT component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.