Red Hat Linux Security Advisories & CVEs
4434 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-92937] vm2 3.11.6 Remote Code Execution via Promise call/apply
vm2 3.11.6 Remote Code Execution via Promise call/apply. Red Hat rates this important (CVSS 8.3). Weakness: CWE-94. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
High [CVE-2026-77874] SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass
SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass. Red Hat rates this important (CVSS 8.6). Weakness: CWE-89. Affected products named by the advisory: Cryostat 4; Red Hat build of Debezium 3; Red Hat Build of Keycloak; Red Hat JBoss Enterprise Application Platform 7; and 4 more. Affected products named by the advisory: Red Hat OpenShift AI (RHOAI); Red Hat OpenStack Platform 13 (Queens); Red Hat Satellite 6; Red Hat Single Sign-On 7.
High [CVE-2026-89418] Denial of Service via uncontrolled recursion in protobuf group field parsing
Denial of Service via uncontrolled recursion in protobuf group field parsing. Red Hat rates this important (CVSS 7.5). Weakness: CWE-606. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
High [CVE-2026-87743] Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security
Authorization Bypass via Path Normalization Discrepancy in Quarkus HTTP Security. Red Hat rates this important (CVSS 7.5). Weakness: CWE-551. Affected products named by the advisory: Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; Red Hat Build of Keycloak; and 2 more. Affected products named by the advisory: Red Hat Fuse 7; Red Hat OpenShift Dev Spaces.
High [CVE-2026-92925] Out-of-bounds read via crafted cluster bus packets
Out-of-bounds read via crafted cluster bus packets. Red Hat rates this important (CVSS 7.1). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:65120 with package redis:7-9060020260917140656.9, redis:7-9080020260821173335.9, redis:7-9040020260917140622.9. Affected products named by the advisory: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Pen Drive Powered by Red Hat Lightspeed; Red Hat 3scale API Management Platform 2; and 1 more. Affected products named by the advisory: Red Hat Hardened Images.
High [CVE-2026-86320] Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder. Red Hat Product Security has rated this flaw as having an Important security impact. Exploitation requires the target build process to process an attacker-controlled or otherwise untrusted source using this option. In typical interactive builds, user interaction is required to initiate the build, while automated build services that process untrusted manifests may be exposed without additional user interaction. Successful exploitation provides code execution with the privileges of the flatpak-builder process and may allow access to or modification of data available to that process. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-94. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: flatpak-builder.
High [CVE-2026-90227] check SUBMIT_IO with nvme_cmd_allowed
check SUBMIT_IO with nvme_cmd_allowed(). Red Hat rates this important (CVSS 7). Weakness: CWE-266. Red Hat lists fixing advisory RHSA-2026:75746 with package kernel-0:4.18.0-553.171.1.el8_10, kernel-rt-0:4.18.0-553.171.1.rt7.512.el8_10. Affected product named by the advisory: Red Hat Enterprise Linux 8.
High [CVE-2026-92599] Denial of Service via `isoDate` validation regular expression
Denial of Service via `isoDate` validation regular expression. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1333. Red Hat lists fixing advisory RHSA-2026:68778 with package grafana13-2-main-13.2.1-0.5.hum1, grafana13-1-main-13.1.6-0.2.hum1, grafana12-4-main-12.4.10-0.6.hum1. Affected products named by the advisory: Red Hat Hardened Images; Gatekeeper 3; Migration Toolkit for Containers; Red Hat Data Grid 8; and 5 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; and 1 more.
High [CVE-2026-92596] Denial of Service in addressparser component
Denial of Service in addressparser component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1050. Affected product named by the advisory: Self-service automation portal 2.
High [CVE-2026-85469] Release workflow uses third-party Action pinned to mutable @master with registry credentials in scope
Release workflow uses third-party Action pinned to mutable @master with registry credentials in scope. Red Hat rates this important (CVSS 8). Weakness: CWE-1357. Affected product named by the advisory: Red Hat Quay 3.
High [CVE-2026-92786] Out-of-bounds write via crafted model file
Out-of-bounds write via crafted model file. Red Hat rates this important (CVSS 7.8). Weakness: CWE-787. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
High [CVE-2026-91106] heap-based buffer overflow can lead to remote code execution
heap-based buffer overflow can lead to remote code execution. Red Hat rates this important (CVSS 8.4). Weakness: CWE-122. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: hplip.
High [CVE-2026-91105] Remote code execution and privilege escalation vulnerabilities
Remote code execution and privilege escalation vulnerabilities. Red Hat rates this important (CVSS 8.8). Weakness: CWE-266. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: hplip.
High [CVE-2026-91102] Multiple vulnerabilities could lead to remote code execution
Multiple vulnerabilities could lead to remote code execution. Red Hat rates this important (CVSS 7.8). Weakness: CWE-494. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: hplip.
High [CVE-2026-91098] Multiple vulnerabilities allow remote code execution and privilege escalation
Multiple vulnerabilities allow remote code execution and privilege escalation. Red Hat rates this important (CVSS 8.8). Weakness: CWE-494. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: hplip.
High [CVE-2026-86003] Unauthorized DNS record modification via unvalidated DNS updates
Unauthorized DNS record modification via unvalidated DNS updates. Red Hat rates this important (CVSS 7.5). Weakness: CWE-306. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Connectivity Link 1; Red Hat OpenShift Container Platform 4.
High [CVE-2026-91097] Multiple vulnerabilities enable remote code execution and privilege escalation
Multiple vulnerabilities enable remote code execution and privilege escalation. Red Hat rates this important (CVSS 8.8). Weakness: CWE-94. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: hplip.
High [CVE-2026-82399] Denial of Service due to unauthenticated memory exhaustion in custom transports
Denial of Service due to unauthenticated memory exhaustion in custom transports. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1050. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Connectivity Link 1; Red Hat OpenShift Container Platform 4.
High [CVE-2026-75516] RabbitMQ Java client: Denial of Service via oversized frames
RabbitMQ Java client: Denial of Service via oversized frames. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat Fuse 7.
High [CVE-2026-46352] Denial of Service via fragmented encapsulated traffic
Denial of Service via fragmented encapsulated traffic. Red Hat rates this important (CVSS 7.5). Weakness: CWE-833.