Red Hat Linux Security Advisories & CVEs
11616 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-91730] Incomplete cleanup in GetUserMedia
Incomplete cleanup in GetUserMedia. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-459.
Medium [CVE-2026-91713] Missing authorization in Browser
Missing authorization in Browser. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-1021.
Medium [CVE-2026-91725] Observable discrepancy in CSS
Observable discrepancy in CSS. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-204.
Medium [CVE-2026-91723] Race condition in WebAppInstalls
Race condition in WebAppInstalls. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-368.
Medium [CVE-2026-91714] Observable discrepancy in Fonts
Observable discrepancy in Fonts. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-204.
Medium [CVE-2026-91746] Integer overflow in Compositing
Integer overflow in Compositing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-190.
Medium [CVE-2026-91708] Race condition in Network
Race condition in Network. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-368.
Medium [CVE-2026-91740] Cross-origin data disclosure due to uninitialized resource in Skia
Cross-origin data disclosure due to uninitialized resource in Skia. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-908. Affected product named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2026-91717] Missing authorization in Android
Missing authorization in Android. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-1220.
Medium [CVE-2026-91747] Cross-origin data disclosure via use-after-free vulnerability
Cross-origin data disclosure via use-after-free vulnerability. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-825. Affected product named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2026-91733] Skia in chromium-browser: Information disclosure via improper state validation
Skia in chromium-browser: Information disclosure via improper state validation. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-125. Affected product named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2026-91744] Race condition in PlatformIntegration
Race condition in PlatformIntegration. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-368.
Medium [CVE-2026-88922] Privilege escalation via crafted archive decompression
Privilege escalation via crafted archive decompression. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-278. Red Hat lists fixing advisory RHSA-2026:68259 with package opentofu1-12-main-1.12.6-0.2.hum1, opentofu1-10-main-1.10.10-0.4.hum1, syft-main-1.51.1-0.2.hum1, grype-main-0.118.0-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Exploit Intelligence; Red Hat Trusted Artifact Signer.
Medium [CVE-2026-92239] Out-of-bounds read via maliciously constructed IMAP line
Out-of-bounds read via maliciously constructed IMAP line. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, thunderbird-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
Medium [CVE-2026-92238] Memory safety violations via maliciously crafted mail headers
Memory safety violations via maliciously crafted mail headers. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-843. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, thunderbird-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
Medium [CVE-2026-79699] Malicious tar whiteout header allows replacement of extraction destination directory
Malicious tar whiteout header allows replacement of extraction destination directory. Red Hat rates this low (CVSS 4.4). Weakness: CWE-59. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat OpenShift Virtualization 4; Red Hat Quay 3.
Medium [CVE-2026-79705] Directory escape via crafted tar symlinks when used outside Buildah by non-root callers
Directory escape via crafted tar symlinks when used outside Buildah by non-root callers. Red Hat rates this moderate (CVSS 4.5). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:74861 with package podman-main-6.1.3-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; and 5 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat OpenShift Virtualization 4; and 1 more.
Medium [CVE-2026-76654] Subpath symlinking on Windows nodes permits NTLM coercion
Subpath symlinking on Windows nodes permits NTLM coercion. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-59. Affected product named by the advisory: Red Hat OpenShift for Windows Containers.
Medium [CVE-2026-2270] StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-1220. Affected products named by the advisory: Logical Volume Manager Storage; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Edge Manager 1; Red Hat Hardened Images; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat OpenShift GitOps.
Medium [CVE-2026-91992] Credential leak via HTTP client handle reuse
Credential leak via HTTP client handle reuse. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-524. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; OpenShift Lightspeed; and 11 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 7 more.