Red Hat Linux Security Advisories & CVEs
2955 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-66782] broker API bearer token stored cleartext in CR spec
broker API bearer token stored cleartext in CR spec. Red Hat rates this important (CVSS 7.8). Weakness: CWE-312. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
High [CVE-2026-75924] Hub addon-manager ClusterRole grants cluster-wide Secret read/write and CSR approval
Hub addon-manager ClusterRole grants cluster-wide Secret read/write and CSR approval. Red Hat rates this important (CVSS 8.7). Weakness: CWE-269. Affected product named by the advisory: Multicluster Engine for Kubernetes.
High [CVE-2026-71365] webhook status callback SSRF leaks the Git PAT
webhook status callback SSRF leaks the Git PAT. Red Hat rates this important (CVSS 7.7). Weakness: CWE-918. Affected product named by the advisory: Red Hat Ansible Automation Platform 2.
High [CVE-2026-66793] arbitrary container image override via ManagedClusterAddOn annotation enables RCE on spoke
arbitrary container image override via ManagedClusterAddOn annotation enables RCE on spoke. Red Hat rates this important (CVSS 8.8). Weakness: CWE-20. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
High [CVE-2026-74990] Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74948] Information disclosure in the Graphics component
Information disclosure in the Graphics component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-497. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74946] Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74949] Privilege escalation due to use-after-free in the Graphics: Canvas2D component
Privilege escalation due to use-after-free in the Graphics: Canvas2D component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74943] Use-after-free in the Graphics: ImageLib component
Use-after-free in the Graphics: ImageLib component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74942] Privilege escalation in the Remote Settings Client component
Privilege escalation in the Remote Settings Client component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74944] Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74941] Privilege escalation in the Graphics: CanvasWebGL component
Privilege escalation in the Graphics: CanvasWebGL component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: thunderbird.
High [CVE-2026-74940] Use-after-free in the Graphics: Text component
Use-after-free in the Graphics: Text component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74934] Site isolation issue in the Graphics: CanvasWebGL component
Site isolation issue in the Graphics: CanvasWebGL component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-653. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74936] Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-74935] Privilege escalation in the DOM: Networking component
Privilege escalation in the DOM: Networking component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-70906] Improve font loading (2026-08 Security Update)
Vulnerability in Oracle Java SE (component: 2D). Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Affected Red Hat products: Red Hat Build of OpenJDK 25.0.4.1; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Exploit Intelligence; Red Hat build of OpenJDK 25; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2026:55799, RHSA-2026:55798, RHSA-2026:57177. Affected products named by the advisory: Red Hat package: java-1.6.0-openjdk; Red Hat package: java-1.7.0-openjdk; Red Hat package: java-1.8.0-openjdk.
High [CVE-2026-34398] Arbitrary Code Execution via malicious BIM project template
Arbitrary Code Execution via malicious BIM project template. Red Hat rates this important (CVSS 7.8). Weakness: CWE-94.
High [CVE-2026-34789] Arbitrary code execution via crafted document restoration
Arbitrary code execution via crafted document restoration. Red Hat rates this important (CVSS 7.8). Weakness: CWE-502.
High [CVE-2026-70495] cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters
cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters. Red Hat rates this important (CVSS 8.8). Weakness: CWE-269. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.