Red Hat Linux Security Advisories & CVEs
11820 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-92248] integer overflow when generating a thumbnail preview for a PSD file
integer overflow when generating a thumbnail preview for a PSD file. Red Hat rates this important (CVSS 7.8). Weakness: CWE-190. Red Hat lists fixing advisory RHSA-2026:75575 with package gimp-2:3.0.4-4.el9_8.14. Affected product named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2025-11395] Podman: arbitrary file write when importing oci archive
A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman. This flaw in Podman allows an attacker to achieve arbitrary file write on the host system. Exploitation requires the attacker to supply a specially crafted OCI archive to the `podman load` command, which then executes with the privileges of the user invoking Podman. This risk is primarily relevant in environments where untrusted OCI archives are routinely processed by Podman users. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-277. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: buildah; Red Hat package: podman; Red Hat package: skopeo.
Medium [CVE-2026-91719] Code injection in XML
Code injection in XML. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-91.
Medium [CVE-2026-91730] Incomplete cleanup in GetUserMedia
Incomplete cleanup in GetUserMedia. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-459.
Medium [CVE-2026-91713] Missing authorization in Browser
Missing authorization in Browser. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-1021.
Medium [CVE-2026-91725] Observable discrepancy in CSS
Observable discrepancy in CSS. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-204.
Medium [CVE-2026-91723] Race condition in WebAppInstalls
Race condition in WebAppInstalls. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-368.
Medium [CVE-2026-91714] Observable discrepancy in Fonts
Observable discrepancy in Fonts. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-204.
Medium [CVE-2026-91746] Integer overflow in Compositing
Integer overflow in Compositing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-190.
Medium [CVE-2026-91708] Race condition in Network
Race condition in Network. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-368.
Medium [CVE-2026-91740] Cross-origin data disclosure due to uninitialized resource in Skia
Cross-origin data disclosure due to uninitialized resource in Skia. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-908. Affected product named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2026-91717] Missing authorization in Android
Missing authorization in Android. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-1220.
Medium [CVE-2026-91747] Cross-origin data disclosure via use-after-free vulnerability
Cross-origin data disclosure via use-after-free vulnerability. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-825. Affected product named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2026-91733] Skia in chromium-browser: Information disclosure via improper state validation
Skia in chromium-browser: Information disclosure via improper state validation. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-125. Affected product named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2026-91744] Race condition in PlatformIntegration
Race condition in PlatformIntegration. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-368.
Medium [CVE-2026-88922] Privilege escalation via crafted archive decompression
Privilege escalation via crafted archive decompression. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-278. Red Hat lists fixing advisory RHSA-2026:68259 with package opentofu1-12-main-1.12.6-0.2.hum1, opentofu1-10-main-1.10.10-0.4.hum1, syft-main-1.51.1-0.2.hum1, grype-main-0.118.0-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Exploit Intelligence; Red Hat Trusted Artifact Signer.
Medium [CVE-2026-92239] Out-of-bounds read via maliciously constructed IMAP line
Out-of-bounds read via maliciously constructed IMAP line. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, thunderbird-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
Medium [CVE-2026-92238] Memory safety violations via maliciously crafted mail headers
Memory safety violations via maliciously crafted mail headers. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-843. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, thunderbird-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.
Medium [CVE-2026-79699] Malicious tar whiteout header allows replacement of extraction destination directory
Malicious tar whiteout header allows replacement of extraction destination directory. Red Hat rates this low (CVSS 4.4). Weakness: CWE-59. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat OpenShift Virtualization 4; Red Hat Quay 3.
Medium [CVE-2026-79705] Directory escape via crafted tar symlinks when used outside Buildah by non-root callers
Directory escape via crafted tar symlinks when used outside Buildah by non-root callers. Red Hat rates this moderate (CVSS 4.5). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:74861 with package podman-main-6.1.3-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; and 5 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat OpenShift Virtualization 4; and 1 more.