Red Hat Linux Security Advisories & CVEs
11901 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Low [CVE-2026-84642] Allowed UNC hostnames for attachments interpreted as a regular expression
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-624. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-84368] @hapi/joi: joi: Prototype pollution via untrusted input in schema configuration
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. A flaw was found in joi. This vulnerability, known as prototype pollution, allows an attacker to inject properties into core JavaScript objects by supplying untrusted input directly into schema-construction configuration. This can lead to a consuming application taking incorrect execution paths, potentially altering its behavior in unexpected ways. Affected products named by the advisory: Gatekeeper 3; Migration Toolkit for Containers; Red Hat Build of Podman Desktop; Red Hat Data Grid 8; and 9 more.
Low [CVE-2026-83608] @xmldom/xmldom: xmldom: XML Markup Injection via DocType Name Bypass
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom.js validates publicId, systemId, and internalSubset under requireWellFormed: true but emits DocumentType.name verbatim. A name containing > or whitespace can terminate the declaration and inject sibling markup; the value can be supplied through createDocumentType() on the 0.8.x and unscoped lines or through a direct DocumentType.name property write on every affected line. The default path and legacy creation-time behavior remain permissive, while the vulnerable strict path fails to enforce an XML Name. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom. A remote attacker can exploit this vulnerability by providing a specially crafted `DocumentType.name` containing characters like `>` or whitespace. This bypasses the `requireWellFormed` validation, allowing the injection of arbitrary XML markup. Such injection can lead to unintended modifications of the XML document structure, potentially resulting in arbitrary code execution or information disclosure within applications that process the affected XML.
Low [CVE-2026-84141] Integer overflow in the Graphics: ImageLib component
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-190. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-84140] Site isolation issue in the DOM: Navigation component
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-1100. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-84139] Clickjacking issue in the DOM: Events component
Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-1021. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-84138] Denial-of-service in the PDF Viewer component
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-835. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-84137] Spoofing issue in the DOM: Core & HTML component
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-290. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-84136] Other issue in the DOM: Navigation component
Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-368. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-84135] Other issue in Firefox Focus for Android
Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-252. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-84134] Other issue in the Profile Backup component
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-915. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-84133] Site isolation issue in the DOM: Push Subscriptions component
Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Low — CVSS 3.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). Weakness: CWE-653. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-18743] Popt-devel: popt-static: short realloc in poptconfigfiletostring
A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service). This Low impact heap overflow in `popt` occurs when processing specially crafted configuration files through an explicit call to `poptConfigFileToString()`. Red Hat products are less exposed as this function is not utilized by internal sources, limiting the attack surface to scenarios where untrusted `popt` configuration content is explicitly loaded. Red Hat severity: Low — CVSS 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-131. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:56984. Affected products named by the advisory: Red Hat package: popt.
Critical [CVE-2026-77849] Hardcoded Grafana admin credentials (admin / admin) in `pkg/specsyncer`
Hardcoded Grafana admin credentials (admin / admin) in `pkg/specsyncer`. Red Hat rates this important (CVSS 9.8). Weakness: CWE-798. Red Hat lists fixing advisory RHSA-2026:68515 with package multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1788376193, multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1788441983, multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1788375682. Affected product named by the advisory: Multicluster Global Hub.
High [CVE-2026-82393] Arbitrary file write and code execution via path traversal in tarball dependency manifest
pnpm is a package manager. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0. A flaw was found in pnpm. This vulnerability allows a remote attacker to perform a path traversal by crafting a malicious tarball dependency's manifest name. This can result in attacker-controlled files overwriting arbitrary filesystem paths, potentially leading to arbitrary code execution on the affected system. This Important vulnerability in pnpm allows arbitrary file write and code execution through a path traversal flaw during tarball dependency installation. An attacker can craft a malicious package.json manifest with a scoped path traversal to overwrite arbitrary files outside the `node_modules` directory, even when `--ignore-scripts` is used. This could lead to system compromise by replacing critical files like shell startup scripts or Git hooks in Red Hat environments where pnpm is used to manage untrusted packages. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-22. Red Hat lists Red Hat AMQ Broker 7; Red Hat Build of Keycloak; Red Hat Hardened Images; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected.
High [CVE-2026-82392] Arbitrary Code Execution via Path Traversal
pnpm is a package manager. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0. If the system is configured to allow lifecycle scripts, this path traversal vulnerability can lead to arbitrary code execution with the user's privileges. This is an Important path traversal vulnerability in pnpm that allows an attacker to write arbitrary files outside the intended `node_modules` directory when a user executes `pnpm install` with a specially crafted `pnpm-lock.yaml`. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L). Weakness: CWE-22. Red Hat lists Red Hat AMQ Broker 7; Red Hat Build of Keycloak; Red Hat Hardened Images; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected.
High [CVE-2026-83596] Validate the full FeatureList array once in OpenTypeVerticalData findFeature
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. For this reason, this flaw has been rated with an important severity. Additionally, this issue can cause memory corruption and the possibility of remote code execution is not discarded. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat fixing advisory: RHSA-2026:74084, RHSA-2026:69098. Affected products named by the advisory: Red Hat package: webkit2gtk3; Red Hat package: webkitgtk4.
High [CVE-2026-13732] Gdb: gdb: out-of-bounds write in stabs parser read_member_functions via crafted elf
A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious.stab and.stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process. While GCC removed STABS emitting support in GCC 13 and GDB deprecated STABS parsing in GDB 17, all deployed GDB versions parse STABS data without user opt-in. An attacker can embed STABS sections in any ELF binary, including one compiled with DWARF debug information, and GDB will parse both. The vulnerability requires the user to open the crafted binary in GDB and issue a symbol-inspection command, which is normal GDB usage. Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-787.
High [CVE-2026-17615] RESTeasy SourceProvider remote unauthenticated file read
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability. An attacker can exploit this by sending a crafted XML request to an exposed endpoint that processes `application/xml` and returns `Source` or `StreamSource` types, leading to the disclosure of sensitive server-side files. This affects applications utilizing RESTEasy where endpoints are configured to accept XML input and return `Source` or `StreamSource` objects, potentially exposing sensitive data on Red Hat supported products. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-611. Affected products named by the advisory: Red Hat build of Keycloak 26.6.7; Red Hat Enterprise Linux 9; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apicurio Registry 3; and 5 more.
High [CVE-2026-78422] Privilege escalation via PID reuse due to incorrect D-Bus type handling
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop. PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the caller-supplied UID and instead determines the subject's owner itself by looking up the PID in /proc, a lookup that is inherently subject to a time-of-check/time-of-use race. Consequently, an application that passes a UID obtained from a trustworthy source — for example SO_PEERCRED Unix socket peer credentials — in order to defend against PID reuse receives no protection, and the supplied UID has no effect on the authorization decision. A local unprivileged attacker who can cause an authorized process to terminate and then win the race to have their own process assigned the same PID can be authorized under the identity of the terminated process, bypassing the polkit authorization check and performing actions the attacker is not entitled to. This issue affects zbus_polkit before 5.1.0. A flaw was found in zbus_polkit. The `Subject::new_for_owner()` function incorrectly encodes the user ID (UID) as an unsigned 32-bit integer instead of a signed 32-bit integer when communicating with the PolicyKit (polkit) authorization framework.