Red Hat Linux Security Advisories & CVEs
514 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Critical [CVE-2026-94083] type confusion and invalid free in DoH2 protocol handling
type confusion and invalid free in DoH2 protocol handling. Red Hat rates this critical (CVSS 9.8). Weakness: CWE-843.
Critical [CVE-2026-75885] Unauthenticated SSRF and resource exhaustion via devfile parser endpoint
Unauthenticated SSRF and resource exhaustion via devfile parser endpoint. Red Hat rates this important (CVSS 9.3). Weakness: CWE-918. Red Hat lists fixing advisory RHSA-2026:70647 with package openshift4/ose-console-rhel9:1789939565, openshift4/ose-console-rhel9:1789904865, openshift4/ose-console-rhel9:1790130905, openshift4/ose-console:1790102793. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.12; Red Hat OpenShift Container Platform 4.17; Red Hat OpenShift Container Platform 4.18; Red Hat OpenShift Container Platform 4.19; and 3 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.20; Red Hat OpenShift Container Platform 4.21; Red Hat OpenShift Container Platform 4.22.
Critical [CVE-2026-93606] vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species. Red Hat rates this critical (CVSS 9.8). Weakness: CWE-653. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-93605] vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
vm2 NodeVM before 3.12.1 Remote Code Execution via child_process. Red Hat rates this critical (CVSS 9.8). Weakness: CWE-184. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-93603] vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function. Red Hat rates this critical (CVSS 9.8). Weakness: CWE-653. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92957] vm2 before 3.11.7 Authentication Bypass via node: Prefix
vm2 before 3.11.7 Authentication Bypass via node: Prefix. Red Hat rates this important (CVSS 9.9). Weakness: CWE-269. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92956] vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming. Red Hat rates this important (CVSS 9.9). Weakness: CWE-693. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92955] vm2 before 3.11.8 Sandbox Escape via NodeVM
vm2 before 3.11.8 Sandbox Escape via NodeVM. Red Hat rates this important (CVSS 10). Weakness: CWE-913. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92953] vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray. Red Hat rates this important (CVSS 9.3). Weakness: CWE-913. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92951] vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver. Red Hat rates this important (CVSS 9.9). Weakness: CWE-706. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92948] vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test. Red Hat rates this important (CVSS 9.9). Weakness: CWE-693. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92944] vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector. Red Hat rates this important (CVSS 9.8). Weakness: CWE-693. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92941] vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation. Red Hat rates this important (CVSS 9.9). Weakness: CWE-732. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92939] vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine. Red Hat rates this important (CVSS 9.9). Weakness: CWE-114. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92938] vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite. Red Hat rates this important (CVSS 9.9). Weakness: CWE-693. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92935] vm2 NodeVM Remote Code Execution via Array-Shaped Require
vm2 NodeVM Remote Code Execution via Array-Shaped Require. Red Hat rates this important (CVSS 9). Weakness: CWE-913. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92934] vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
vm2 before 3.11.8 Sandbox Escape RCE via AggregateError. Red Hat rates this important (CVSS 9). Weakness: CWE-693. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Critical [CVE-2026-92828] Operator ServiceAccount bound to cluster-admin
Operator ServiceAccount bound to cluster-admin. Red Hat rates this important (CVSS 9). Weakness: CWE-250. Affected product named by the advisory: Red Hat OpenShift Container Platform 4.
Critical [CVE-2026-59969] Improper certificate validation in FIPS mode allows quorum compromise
Improper certificate validation in FIPS mode allows quorum compromise. Red Hat rates this important (CVSS 9). Weakness: CWE-295. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; and 2 more. Affected products named by the advisory: Red Hat Offline Knowledge Portal; Red Hat OpenShift AI (RHOAI).
Critical [CVE-2026-81642] Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY. Red Hat rates this critical (CVSS 9.8). Weakness: CWE-122. Red Hat lists fixing advisory RHSA-2026:71419 with package unbound-0:1.6.6-5.el7_9.2, unbound-0:1.16.2-3.el9_2.6, unbound-0:1.16.2-8.el9_4.3, unbound-0:1.16.2-19.el9_6.2. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8.