Red Hat Linux Security Advisories & CVEs
3038 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-17685] Use after free in Autofill
Use after free in Autofill. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825.
High [CVE-2026-17680] Heap buffer overflow in Color
Heap buffer overflow in Color. Red Hat rates this important (CVSS 8.2). Weakness: CWE-787.
High [CVE-2026-17674] Inappropriate implementation in HTML
Inappropriate implementation in HTML. Red Hat rates this important (CVSS 8.8).
High [CVE-2026-17671] Insufficient validation of untrusted input in ANGLE
Insufficient validation of untrusted input in ANGLE. Red Hat rates this important (CVSS 8.2). Weakness: CWE-1286.
High [CVE-2026-17670] Use after free in Views
Use after free in Views. Red Hat rates this important (CVSS 8.2). Weakness: CWE-825.
High [CVE-2026-17666] Cryptographic Flaw in Enterprise
Cryptographic Flaw in Enterprise. Red Hat rates this important (CVSS 8.1). Weakness: CWE-347.
High [CVE-2026-17659] Inappropriate implementation in SiteIsolation
Inappropriate implementation in SiteIsolation. Red Hat rates this important (CVSS 8.7). Weakness: CWE-653.
High [CVE-2026-17658] Use after free in V8
Use after free in V8. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825.
High [CVE-2026-17661] Use after free in Loader
Use after free in Loader. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825.
High [CVE-2026-17657] Use after free in Navigation
Use after free in Navigation. Red Hat rates this important (CVSS 8.2). Weakness: CWE-825.
High [CVE-2026-17654] Race in Updater
Race in Updater. Red Hat rates this critical (CVSS 8.8). Weakness: CWE-367.
High [CVE-2026-18378] cluster pull-secret token exfiltration via user-controlled api_url (SSRF / confused deputy)
cluster pull-secret token exfiltration via user-controlled api_url (SSRF / confused deputy). Red Hat rates this important (CVSS 7.6). Weakness: CWE-918.
High [CVE-2026-18381] operator service-account token exfiltration via user-controlled Prometheus service_address
operator service-account token exfiltration via user-controlled Prometheus service_address. Red Hat rates this important (CVSS 7.6). Weakness: CWE-918.
High [CVE-2026-5056] Arbitrary code execution via stack-based buffer overflow in qtdemux
Arbitrary code execution via stack-based buffer overflow in qtdemux. Red Hat rates this important (CVSS 7.8). Weakness: CWE-121. Red Hat lists fixing advisory RHSA-2026:49508 with package gstreamer1-plugins-good-0:1.26.7-2.el10_2.2. Affected product named by the advisory: Red Hat Enterprise Linux 10.
High [CVE-2026-18022] Arbitrary Code Execution via Integer Wraparound
Arbitrary Code Execution via Integer Wraparound. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787.
High [CVE-2026-67201] Server-Side Request Forgery (SSRF) bypass due to URL parser differential
Server-Side Request Forgery (SSRF) bypass due to URL parser differential. Red Hat rates this important (CVSS 8.6). Weakness: CWE-168.
High [CVE-2026-18255] Global read-only superuser can view robot account tokens
Global read-only superuser can view robot account tokens. Red Hat rates this important (CVSS 7.2). Weakness: CWE-863.
High [CVE-2026-13697] Information disclosure and Denial of Service via malformed Cache-Control directives
Information disclosure and Denial of Service via malformed Cache-Control directives. Red Hat rates this important (CVSS 7.4). Weakness: CWE-524. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs24-main-24.18.1-0.1.hum1.
High [CVE-2026-55707] Shared-network consumer can re-scope another project's subnets via subnetpool onboarding
Shared-network consumer can re-scope another project's subnets via subnetpool onboarding. Red Hat rates this important (CVSS 7.1). Weakness: CWE-863.
High [CVE-2026-55995] Denial of Service via double-free in iSNS attribute decoder
Denial of Service via double-free in iSNS attribute decoder. Red Hat rates this important (CVSS 7.5). Weakness: CWE-763. Red Hat lists fixing advisory RHSA-2026:53848 with package isns-utils-0:0.103-1.el10_2.1, isns-utils-0:0.99-1.el8_10.1, isns-utils-0:0.101-4.el9_8.1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.