Red Hat Linux Security Advisories & CVEs
4426 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-103484] Arbitrary code execution via out-of-bounds write during IVFFlat index build
Arbitrary code execution via out-of-bounds write during IVFFlat index build. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787. Affected product named by the advisory: Red Hat Enterprise Linux 9.
High [CVE-2026-15911] Information disclosure via improper TLS certificate validation in HashiCorp Vault integration
Information disclosure via improper TLS certificate validation in HashiCorp Vault integration. Red Hat rates this important (CVSS 7.4). Weakness: CWE-295. Affected product named by the advisory: Red Hat Satellite 6.
High [CVE-2023-54404] Denial of service via unbounded array validation
Denial of service via unbounded array validation. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Cost Management On Premise; Migration Toolkit for Applications 8; Red Hat Ansible Automation Platform 2; and 21 more. Affected products named by the advisory: Red Hat Build of Keycloak; Red Hat Build of Podman Desktop; Red Hat Data Grid 8; Red Hat Developer Hub; and 17 more.
High [CVE-2026-12544] SSTI and insecure deserialization in foreman-rake configuration
SSTI and insecure deserialization in foreman-rake configuration. Red Hat rates this important (CVSS 7.7). Weakness: CWE-502. Red Hat lists fixing advisory RHSA-2026:74503 with package foreman-0:3.14.0.22-1.el9sat, foreman-0:3.16.0.25-1.el9sat, foreman-0:3.12.0.23-1.el8sat, foreman-0:3.18.0.14-1.el9sat. Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.18 for RHEL 9; and 1 more. Affected products named by the advisory: Red Hat Satellite 6.19 for RHEL 9.
High [CVE-2026-12541] command injection in foreman-rake database tasks
command injection in foreman-rake database tasks. Red Hat rates this important (CVSS 8.2). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:74503 with package foreman-0:3.14.0.22-1.el9sat, foreman-0:3.16.0.25-1.el9sat, foreman-0:3.12.0.23-1.el8sat, foreman-0:3.18.0.14-1.el9sat. Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.18 for RHEL 9; and 1 more. Affected products named by the advisory: Red Hat Satellite 6.19 for RHEL 9.
High [CVE-2026-12540] command injection in foreman-rake errors:fetch_log via request_id parameter
command injection in foreman-rake errors:fetch_log via request_id parameter. Red Hat rates this important (CVSS 8.2). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:74503 with package foreman-0:3.14.0.22-1.el9sat, foreman-0:3.16.0.25-1.el9sat, foreman-0:3.12.0.23-1.el8sat, foreman-0:3.18.0.14-1.el9sat. Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.18 for RHEL 9; and 1 more. Affected products named by the advisory: Red Hat Satellite 6.19 for RHEL 9.
High [CVE-2026-12423] unauthenticated information disclosure via provisioning token validation flaw
unauthenticated information disclosure via provisioning token validation flaw. Red Hat rates this important (CVSS 7.5). Weakness: CWE-306. Red Hat lists fixing advisory RHSA-2026:74503 with package foreman-0:3.14.0.22-1.el9sat, foreman-0:3.16.0.25-1.el9sat, foreman-0:3.12.0.23-1.el8sat, foreman-0:3.18.0.14-1.el9sat. Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.18 for RHEL 9; and 1 more. Affected products named by the advisory: Red Hat Satellite 6.19 for RHEL 9.
High [CVE-2026-12405] command injection in job invocations via effective_user parameter
command injection in job invocations via effective_user parameter. Red Hat rates this important (CVSS 8.8). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:74503 with package rubygem-foreman_remote_execution-0:16.2.3-2.el9sat, rubygem-foreman_remote_execution-0:15.0.2-2.el9sat, rubygem-foreman_remote_execution-0:13.2.8-2.el9sat, rubygem-foreman_remote_execution-0:16.5.3-2.el9sat. Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.18 for RHEL 9; and 1 more. Affected products named by the advisory: Red Hat Satellite 6.19 for RHEL 9.
High [CVE-2026-63686] Denial of Service via charset conversion failure in mod_xml2enc
Denial of Service via charset conversion failure in mod_xml2enc. Red Hat rates this important (CVSS 7.5). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:74858 with package httpd-main-2.4.69-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: httpd.
High [CVE-2026-73636] Authentication bypass via credential replay in mod_auth_digest
Authentication bypass via credential replay in mod_auth_digest. Red Hat rates this important (CVSS 8.1). Weakness: CWE-294. Red Hat lists fixing advisory RHSA-2026:74858 with package httpd-main-2.4.69-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: httpd.
High [CVE-2026-63718] HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi
HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi. Red Hat rates this important (CVSS 7.5). Weakness: CWE-444. Red Hat lists fixing advisory RHSA-2026:74858 with package httpd-main-2.4.69-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: httpd.
High [CVE-2026-63292] Arbitrary code execution via oversized Host header in mod_vhost_alias
Arbitrary code execution via oversized Host header in mod_vhost_alias. Red Hat rates this important (CVSS 8.1). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:74858 with package httpd-main-2.4.69-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: httpd.
High [CVE-2026-59685] Denial of Service via out-of-bounds write during Windows path expansion
Denial of Service via out-of-bounds write during Windows path expansion. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787.
High [CVE-2026-56153] Denial of Service via heap-based buffer overflow in mod_charset_lite
Denial of Service via heap-based buffer overflow in mod_charset_lite. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:74858 with package httpd-main-2.4.69-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: httpd.
High [CVE-2026-46729] Denial of Service via NULL pointer dereference
Denial of Service via NULL pointer dereference. Red Hat rates this important (CVSS 7.5). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:74858 with package httpd-main-2.4.69-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: httpd.
High [CVE-2026-103262] Denial of Service via decompression bomb in CurlAsyncHTTPClient
Denial of Service via decompression bomb in CurlAsyncHTTPClient. Red Hat rates this important (CVSS 7.5). Weakness: CWE-409. Affected products named by the advisory: Lightspeed Core; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; and 10 more. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; and 6 more.
High [CVE-2026-103000] Denial of Service via large alphabetical page labels
Denial of Service via large alphabetical page labels. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3.
High [CVE-2026-102999] Denial of Service via crafted PDF with numerous embedded files
Denial of Service via crafted PDF with numerous embedded files. Red Hat rates this important (CVSS 7.5). Weakness: CWE-606. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3.
High [CVE-2026-102998] Denial of Service via crafted PDF form fields
Denial of Service via crafted PDF form fields. Red Hat rates this important (CVSS 7.5). Weakness: CWE-606. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3.
High [CVE-2026-102997] Denial of Service via crafted FlateDecode stream
Denial of Service via crafted FlateDecode stream. Red Hat rates this important (CVSS 7.5). Weakness: CWE-835. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3.