Red Hat Linux Security Advisories & CVEs
5485 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Linux release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Linux advisories
High [CVE-2026-64557] Fix use-after-free in l2cap_sock_new_connection_cb
Fix use-after-free in l2cap_sock_new_connection_cb(). Red Hat rates this moderate (CVSS 7). Weakness: CWE-825.
High [CVE-2026-64558] Check length in pkey_pckmo handler implementation
Check length in pkey_pckmo handler implementation. Red Hat rates this important (CVSS 7). Weakness: CWE-787.
High [CVE-2026-64559] Check length in PKEY_VERIFYPROTK ioctl
Check length in PKEY_VERIFYPROTK ioctl. Red Hat rates this moderate (CVSS 7). Weakness: CWE-805.
High [CVE-2026-64560] Prevent UAF caused by non-leader exec race
Prevent UAF caused by non-leader exec() race. Red Hat rates this important (CVSS 7). Weakness: CWE-364.
Medium [CVE-2026-62343] Denial of Service via heap buffer over-write in morphology operation with invalid kernel
Denial of Service via heap buffer over-write in morphology operation with invalid kernel. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-805.
Medium [CVE-2026-64685] Information Disclosure via Crafted Image File
Information Disclosure via Crafted Image File. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-125.
Medium [CVE-2026-15157] HTTP header injection via unvalidated blob-like body type property
undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like body (via request, stream, pipeline, or dispatch) whose type is derived from untrusted input allows an attacker to inject CRLF sequences and append arbitrary HTTP headers, potentially smuggling a second request past the upstream. Native Blob objects are safe because their constructor strips CRLF from the type, and fetch is unaffected because it validates headers, but ecosystem libraries that build duck-typed blob shapes from user input can reach the vulnerable path. This is the same defect class as CVE-2022-35948 and CVE-2026-1527, on a header sink that the earlier fixes did not cover. A flaw was found in undici. This could result in limited information disclosure and integrity impact. Red Hat severity: Moderate — CVSS 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Weakness: CWE-93. Affected Red Hat products: Red Hat Hardened Images. Will not fix / out of support: Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:48273, RHSA-2026:48537.
Medium [CVE-2026-14643] Cross-user information disclosure due to improper Cache-Control directive parsing
Cross-user information disclosure due to improper Cache-Control directive parsing. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-524. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs24-main-24.18.1-0.1.hum1.
Medium [CVE-2026-16728] Response desynchronization via retry interceptor with mismatched Content-Length
Response desynchronization via retry interceptor with mismatched Content-Length. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-444. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs24-main-24.18.1-0.1.hum1.
Medium [CVE-2026-54249] Information disclosure through unvalidated file references.
Information disclosure through unvalidated file references. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-918.
Medium [CVE-2026-46678] Server-Side Request Forgery (SSRF) bypass exposes cloud credentials.
Server-Side Request Forgery (SSRF) bypass exposes cloud credentials. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-918.
Medium [CVE-2026-13346] Arbitrary file installation via malicious package indexes
Arbitrary file installation via malicious package indexes. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:48788 with package python-pip-main-26.2-0.1.hum1.
Medium [CVE-2026-62995] JWT Malleability via Non-Standard Padding
JWT Malleability via Non-Standard Padding. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-1286. Red Hat lists fixing advisory RHSA-2026:48758 with package jaeger-main-2.20.0-0.8.hum1.
Medium [CVE-2026-16729] Cookie attribute injection allows bypassing security protections
Cookie attribute injection allows bypassing security protections. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-140. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs24-main-24.18.1-0.1.hum1.
Medium [CVE-2026-52791] Privilege Escalation Vulnerability via SUID/SGID Bit Preservation
Privilege Escalation Vulnerability via SUID/SGID Bit Preservation. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-281.
Medium [CVE-2026-67216] Denial of Service due to inefficient JSON object comparison
Denial of Service due to inefficient JSON object comparison. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770.
Medium [CVE-2026-50642] Terminal escape injection allows command execution
Terminal escape injection allows command execution. Red Hat rates this moderate (CVSS 4.4). Weakness: CWE-94.
Medium [CVE-2026-56390] Arbitrary file overwrite via grammar-defined output paths
Arbitrary file overwrite via grammar-defined output paths. Red Hat rates this moderate (CVSS 5.6). Weakness: CWE-22.
Medium [CVE-2026-18201] Generic identity-provider creation can bind brokers to organizations without manage-organizations
Generic identity-provider creation can bind brokers to organizations without manage-organizations. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-862.
Medium [CVE-2026-18207] CVE-2026-18207
CVE-2026-18207. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-285.