Red Hat Linux Security Advisories & CVEs
10922 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-94287] Denial of Service via unsigned integer underflow
Denial of Service via unsigned integer underflow. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-191. Red Hat lists fixing advisory RHSA-2026:47072 with package libxpm-main-3.5.19-4.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libxpm.
Medium [CVE-2026-94285] Denial of Service via out-of-bounds read in byte-oriented codeset parser
Denial of Service via out-of-bounds read in byte-oriented codeset parser. Red Hat rates this moderate (CVSS 5.1). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: libx11.
Medium [CVE-2026-101016] Improper policy enforcement via malformed DMARC record tags
Improper policy enforcement via malformed DMARC record tags. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1286.
Medium [CVE-2026-94284] Denial of Service via out-of-bounds read in XIM trigger-key registration parser
Denial of Service via out-of-bounds read in XIM trigger-key registration parser. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: libx11.
Medium [CVE-2026-94283] Denial of Service via out-of-bounds read in XIM attribute parser
Denial of Service via out-of-bounds read in XIM attribute parser. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: libx11.
Medium [CVE-2026-101003] Denial of Service via stack-based buffer overflow in MQTT broker
Denial of Service via stack-based buffer overflow in MQTT broker. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-787.
Low [CVE-2026-97027] Denial of service via unsanitized keys in exported Desktop Entry / D-Bus Service files
Denial of service via unsanitized keys in exported Desktop Entry / D-Bus Service files. Red Hat rates this low (CVSS 3.6). Weakness: CWE-20. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: flatpak.
Low [CVE-2026-97026] World-writable temporary child repositories in system-helper cache path
World-writable temporary child repositories in system-helper cache path. Red Hat rates this low (CVSS 3.9). Weakness: CWE-378. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: flatpak.
Low [CVE-2026-97025] World-readable OCI authentication token in system-helper cache path
World-readable OCI authentication token in system-helper cache path. Red Hat rates this low (CVSS 3.2). Weakness: CWE-378. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: flatpak.
Low [CVE-2026-97399] Denial of Service via out-of-bounds read in strncasecmp
Denial of Service via out-of-bounds read in strncasecmp. Red Hat rates this low (CVSS 3.7). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: glibc; Red Hat package: compat-glibc.
Low [CVE-2026-101333] Unbounded metric series creation via idp tag on broker login endpoint
Unbounded metric series creation via idp tag on broker login endpoint. Red Hat rates this moderate (CVSS 3.7). Weakness: CWE-770. Affected product named by the advisory: Red Hat Build of Keycloak.
High [CVE-2026-96280] Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems. Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The malicious stream is served over the network (AV:N), and the attacker needs only control over the OCI registry content (PR:N). This overflow only manifests on 32-bit targets — on 64-bit systems gsize and guint64 are the same width and truncation does not occur, so exploitability depends on a target configuration outside the attacker's control (AC:H). Meaningful user interaction is required (UI:R). The vulnerable and impacted components remain within the same flatpak client/helper security authority (S:U). Because this is a heap buffer overflow with a stated path to code execution in the Flatpak client process, a successful exploit is treated as a full compromise of that process's privileges (C:H/I:H/A:H). Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-197.
High [CVE-2026-101044] Arbitrary file creation outside project directory via lockfile path traversal
Arbitrary file creation outside project directory via lockfile path traversal. Red Hat rates this important (CVSS 7.1). Weakness: CWE-22. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat Build of Keycloak; Red Hat OpenShift GitOps.
High [CVE-2026-101043] Information disclosure via environment variable expansion in proxy settings
Information disclosure via environment variable expansion in proxy settings. Red Hat rates this important (CVSS 7.4). Weakness: CWE-201. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat Build of Keycloak; Red Hat OpenShift GitOps.
High [CVE-2026-100723] Information disclosure via zlib shared buffer pool
Information disclosure via zlib shared buffer pool. Red Hat rates this important (CVSS 7.5). Weakness: CWE-653.
Medium [CVE-2026-96281] Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes
On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's remote ref via the unprivileged system-helper RemoveLocalRef method, causing the anti-downgrade check to fail to find a reference date. A malicious local user could use this to expose other users of the same system to an app version with unfixed vulnerabilities. Red Hat estimates the CVSSv3.1 vector from the provided vector CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Specific conditions must exist for the attack to occur and user interaction is required. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-284. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: flatpak.
Medium [CVE-2026-96279] Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks
A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as /etc/shadow. Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The malicious archive is served over the network (AV:N), and the attacker needs no privileges of their own on the victim system (PR:N). Once the client pulls the crafted layer archive, exploitation is deterministic: Flatpak's OCI extraction rebases archive entry pathnames to the destination directory and enforces ARCHIVE_EXTRACT_SECURE_NODOTDOT to reject.. in pathnames and hardlink targets, but it fails to rebase the hardlink target itself, so a crafted entry with an absolute hardlink target (e.g. /etc/shadow) causes libarchive to hardlink that host file directly into the extraction directory (AC:L). Meaningful user interaction is required (UI:R). On system-wide installs, this extraction runs via the privileged system-helper as root, so the hardlinked file can be an arbitrary root-owned file the attacker has no other means to access. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: flatpak.
Medium [CVE-2026-100722] Denial of Service via unhandled Promise rejection in construct trap
Denial of Service via unhandled Promise rejection in construct trap. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-248. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Low [CVE-2026-96284] Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control. Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. Exploitation requires the attacker to be a local, authenticated user able to trigger a system-wide OCI image import via the flatpak-system-helper D-Bus service (AV:L, PR:L). This depends on the uncommon, non-default environmental precondition that a system OCI repository is configured (AC:H). No interaction from another party is required (UI:N). The vulnerable and impacted components remain within the same overall flatpak client/helper security authority (S:U). While some host file content can leak via this symlink-following behavior, disclosure surfaces only through the attacker's own crafted import under the rarer system-OCI-repository precondition, rather than through a broadly repeatable read of arbitrary files (C:L). There is no integrity or availability impact (I:N/A:N). Red Hat severity: Low — CVSS 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-59. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Low [CVE-2026-96282] Flatpak: flatpak: extension metadata path traversal file existence oracle
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox. Red Hat estimates the CVSSv3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Exploitation requires a user to install a malicious Flatpak extension and use it with an application (AV:N, PR:N). The victim must specifically use a malicious extension in combination with a consuming application, and then launch that application (AC:H, UI:R). When Flatpak launches an application, it performs host-side file operations inside extension content directories using path-based APIs that follow symlinks without confinement; a malicious extension can place symlinks pointing at arbitrary host paths, which are followed both when checking for the.ref lock marker file and when iterating merge_dirs directories. These operations run at the invoking user's own privilege level rather than via the privileged system-helper (S:U). While the flaw allows probing for file/directory existence and disclosing filenames via reflected directory listings, no file contents are disclosed (C:N).