Red Hat Linux Security Advisories & CVEs
4448 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-85234] Denial of Service due to out-of-bounds read/write in remap engine
Denial of Service due to out-of-bounds read/write in remap engine. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: tftp.
High [CVE-2026-91990] Denial of Service via memory amplification in multipart parsing
Denial of Service via memory amplification in multipart parsing. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; OpenShift Lightspeed; and 9 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; and 5 more.
High [CVE-2026-91964] Remote code execution via heap buffer overflow in Server Redirection PDU
Remote code execution via heap buffer overflow in Server Redirection PDU. Red Hat rates this important (CVSS 8.8). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:75570 with package freerdp-2:3.10.3-12.el10_2.14. Affected product named by the advisory: Red Hat Enterprise Linux 10.
High [CVE-2026-91963] Remote code execution via uninitialized heap memory disclosure
Remote code execution via uninitialized heap memory disclosure. Red Hat rates this important (CVSS 8.8). Weakness: CWE-824. Red Hat lists fixing advisory RHSA-2026:75570 with package freerdp-2:3.10.3-12.el10_2.14. Affected product named by the advisory: Red Hat Enterprise Linux 10.
High [CVE-2026-91955] Denial of Service via crafted desktop dimensions
Denial of Service via crafted desktop dimensions. Red Hat rates this important (CVSS 7.5). Weakness: CWE-369. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: freerdp.
High [CVE-2026-91950] Out-of-bounds read leads to denial of service or information disclosure
Out-of-bounds read leads to denial of service or information disclosure. Red Hat rates this important (CVSS 7.1). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:75570 with package freerdp-2:3.10.3-12.el10_2.14. Affected product named by the advisory: Red Hat Enterprise Linux 10.
High [CVE-2026-91948] Arbitrary code execution via oversized channel messages in SHOW_PROTOCOL
Arbitrary code execution via oversized channel messages in SHOW_PROTOCOL. Red Hat rates this important (CVSS 7.5). Weakness: CWE-124. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: freerdp.
High [CVE-2026-91947] Use-after-free vulnerability in DRDYNVC parser leads to memory corruption
Use-after-free vulnerability in DRDYNVC parser leads to memory corruption. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:75570 with package freerdp-2:3.10.3-12.el10_2.14. Affected product named by the advisory: Red Hat Enterprise Linux 10.
High [CVE-2024-14029] Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding. Red Hat rates this important (CVSS 7.5). Weakness: CWE-444. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat package: python-tornado.
High [CVE-2023-54397] Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
Tornado before 6.3.3 HTTP Request Smuggling via Content-Length. Red Hat rates this critical (CVSS 7.5). Weakness: CWE-444. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat package: python-tornado.
High [CVE-2026-85013] Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters
Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters. Red Hat rates this moderate (CVSS 7.3). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:64766 with package environment-modules-main-5.6.2-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: environment-modules.
High [CVE-2026-54167] github.com/openshift-pipelines/pipelines-as-code: Pipelines-as-Code: GitHub App token redirection via untrusted host header
github.com/openshift-pipelines/pipelines-as-code: Pipelines-as-Code: GitHub App token redirection via untrusted host header. Red Hat rates this important (CVSS 8.2). Weakness: CWE-345. Affected products named by the advisory: Red Hat Web Terminal.
High [CVE-2026-39919] Heap buffer overflow via JPEG 2000 output adapter
Heap buffer overflow via JPEG 2000 output adapter. Red Hat rates this moderate (CVSS 7.8). Weakness: CWE-122. Red Hat lists fixing advisory RHSA-2026:74464 with package ghostscript-0:9.54.0-19.el9_8.1, ghostscript-0:10.02.1-16.el10_2.1. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10.
High [CVE-2026-92038] Mitigation bypass in the Remote Settings Client component
Mitigation bypass in the Remote Settings Client component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-807.
High [CVE-2026-92037] Incorrect boundary conditions in the DOM: Animation component
Incorrect boundary conditions in the DOM: Animation component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787.
High [CVE-2026-92036] Incorrect boundary conditions in the Networking: HTTP component
Incorrect boundary conditions in the Networking: HTTP component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787.
High [CVE-2026-92035] Sandbox escape due to incorrect boundary conditions in the Graphics component
Sandbox escape due to incorrect boundary conditions in the Graphics component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-501.
High [CVE-2026-92034] Site isolation issue in the Graphics component
Site isolation issue in the Graphics component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-653.
High [CVE-2026-92033] Privilege escalation in Firefox for Android
Privilege escalation in Firefox for Android. Red Hat rates this important (CVSS 7.5). Weakness: CWE-266.
High [CVE-2026-92029] Use-after-free in the SVG component
Use-after-free in the SVG component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:73130 with package thunderbird-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el9_8, firefox-0:140.16.0-1.el8_10, thunderbird-0:140.16.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 10.