Red Hat Linux Security Advisories & CVEs
4893 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-23231] Privilege escalation or denial of service via use-after-free in nf_tables_addchain()
Privilege escalation or denial of service via use-after-free in nf_tables_addchain(). Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-416. Affected package(s): kernel-rt, kernel. Resolved in Red Hat advisory RHSA-2026:10756 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1.
High [CVE-2025-71238] Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation.
Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation.. Red Hat rates this moderate (CVSS 7.3). Weakness: CWE-672. Affected package(s): kernel, kernel-rt. Resolved in Red Hat advisory RHSA-2026:9870 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 7.
High [CVE-2026-27622] Arbitrary code execution via integer overflow in EXR file processing
Arbitrary code execution via integer overflow in EXR file processing. Red Hat rates this important (CVSS 7.4). Weakness: CWE-190. Affected package(s): openexr, rhaiis/vllm-rocm-rhel9:1778244531, OpenEXR, rhaiis/vllm-cuda-rhel9:1778274666, rhaiis/vllm-spyre-rhel9:1778244546, rhaiis/model-opt-cuda-rhel9:1778244559. Resolved in Red Hat advisory RHSA-2026:12339 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 10 more.
High [CVE-2026-25673] Denial of Service via slow URL normalization on Windows
Denial of Service via slow URL normalization on Windows. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3540] Inappropriate implementation in WebAudio
Inappropriate implementation in WebAudio. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3536] Integer overflow in ANGLE
Integer overflow in ANGLE. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3545] Insufficient data validation in Navigation
Insufficient data validation in Navigation. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3542] Inappropriate implementation in WebAssembly
Inappropriate implementation in WebAssembly. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3538] Integer overflow in Skia
Integer overflow in Skia. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3541] Inappropriate implementation in CSS
Inappropriate implementation in CSS. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3544] Heap buffer overflow in WebCodecs
Heap buffer overflow in WebCodecs. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3338] Signature bypass due to improper validation in PKCS7_verify()
Signature bypass due to improper validation in PKCS7_verify(). Red Hat rates this important (CVSS 7.5). Weakness: CWE-347. Affected package(s): rhtas/tuffer-rhel9:1773307309, rhtas/tuftool-rhel9:1773307309. Resolved in Red Hat advisory RHSA-2026:5459 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Trusted Artifact Signer 1.3; Confidential Compute Attestation; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; and 2 more.
High [CVE-2026-3336] Certificate validation bypass via improper handling of PKCS7 objects
Certificate validation bypass via improper handling of PKCS7 objects. Red Hat rates this important (CVSS 7.5). Weakness: CWE-295. Affected package(s): rhtas/tuffer-rhel9:1773307309, rhtas/tuftool-rhel9:1773307309. Resolved in Red Hat advisory RHSA-2026:5459 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Trusted Artifact Signer 1.3; Confidential Compute Attestation; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; and 2 more.
High [CVE-2026-28416] Server-Side Request Forgery allows access to internal services via malicious Space loading
Server-Side Request Forgery allows access to internal services via malicious Space loading. Red Hat rates this important (CVSS 8.2). Weakness: CWE-918. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-28406] Arbitrary code execution via path traversal in build context archive unpacking
Arbitrary code execution via path traversal in build context archive unpacking. Red Hat rates this important (CVSS 8.5). Weakness: CWE-22. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-2293] Authentication bypass via Fastify path-normalization
Authentication bypass via Fastify path-normalization. Red Hat rates this important (CVSS 7.5). Weakness: CWE-551. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3304] Denial of Service via malformed requests
Denial of Service via malformed requests. Red Hat rates this important (CVSS 7.5). Weakness: CWE-459. Affected package(s): rhdh/rhdh-hub-rhel9:1774545605, rhdh/rhdh-hub-rhel9:1775140647. Resolved in Red Hat advisory RHSA-2026:6174 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Developer Hub 1.8; Red Hat Developer Hub 1.9.
High [CVE-2026-2359] Denial of Service via dropped file upload connections
Denial of Service via dropped file upload connections. Red Hat rates this important (CVSS 7.5). Weakness: CWE-772. Affected package(s): rhdh/rhdh-hub-rhel9:1774545605, rhdh/rhdh-hub-rhel9:1775140647. Resolved in Red Hat advisory RHSA-2026:6174 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Developer Hub 1.8; Red Hat Developer Hub 1.9.
High [CVE-2026-28364] Remote code execution via buffer over-read in Marshal deserialization
Remote code execution via buffer over-read in Marshal deserialization. Red Hat rates this important (CVSS 7.9). Weakness: CWE-125. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-27970] @angular/core: Angular: Cross-site scripting via compromised translation files
@angular/core: Angular: Cross-site scripting via compromised translation files. Red Hat rates this important (CVSS 7.1). Weakness: CWE-79. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Fuse 7.