Red Hat Linux Security Advisories & CVEs
3176 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-19617] Denial of Service via uncontrolled recursion in config parser
Denial of Service via uncontrolled recursion in config parser. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.
Medium [CVE-2026-73416] Extension blocklist bypass via weak package-name canonicalization
Extension blocklist bypass via weak package-name canonicalization. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-1289.
Medium [CVE-2026-73428] Stored Cross-Site Scripting via HTML paste allows arbitrary code execution.
Stored Cross-Site Scripting via HTML paste allows arbitrary code execution. Red Hat rates this moderate (CVSS 4.6). Weakness: CWE-79.
Medium [CVE-2026-73480] Terminal Injection via Unstripped Escape Sequences
Terminal Injection via Unstripped Escape Sequences. Red Hat rates this moderate (CVSS 5). Weakness: CWE-838.
Medium [CVE-2026-72647] Denial of Service via uncontrolled recursion in search requests
Denial of Service via uncontrolled recursion in search requests. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-606. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-72656] Denial of Service via excessive memory allocation in ES|QL queries
Denial of Service via excessive memory allocation in ES|QL queries. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-789.
Medium [CVE-2026-72678] Denial of Service via excessive memory allocation
Denial of Service via excessive memory allocation. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770.
Medium [CVE-2026-73651] Arbitrary code execution via template literal code injection
Arbitrary code execution via template literal code injection. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-917. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-73648] Cross-Site Scripting vulnerability due to improper SVG sanitization
Cross-Site Scripting vulnerability due to improper SVG sanitization. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79.
Medium [CVE-2026-19730] Quadlet install --replace non-truncating write retains removed host-access directives
Quadlet install --replace non-truncating write retains removed host-access directives. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-459. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: podman.
Medium [CVE-2026-73565] @hono/node-server: @hono/node-server: Denial of Service via aborted WebSocket handshake
@hono/node-server: @hono/node-server: Denial of Service via aborted WebSocket handshake. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-459.
Medium [CVE-2026-73563] @backstage/plugin-auth-backend: Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
@backstage/plugin-auth-backend: Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-1289. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-58438] Unauthorized tampering and commenting on private repositories via insecure direct object reference
Unauthorized tampering and commenting on private repositories via insecure direct object reference. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-639. Affected product named by the advisory: OpenShift Pipelines.
Medium [CVE-2026-58428] Attachment allowlist bypass via web release edit form
Attachment allowlist bypass via web release edit form. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-434.
Medium [CVE-2026-58427] Information disclosure of private organization member lists
Information disclosure of private organization member lists. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-359. Affected product named by the advisory: OpenShift Pipelines.
Medium [CVE-2026-58417] Information disclosure via REST API exposes private organization membership
Information disclosure via REST API exposes private organization membership. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-863. Affected product named by the advisory: OpenShift Pipelines.
Medium [CVE-2026-58416] Information disclosure via Fork-PR Actions task
Information disclosure via Fork-PR Actions task. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1220. Affected product named by the advisory: OpenShift Pipelines.
Medium [CVE-2026-56657] Denial of Service in SSH Key Parser
Denial of Service in SSH Key Parser. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770.
Medium [CVE-2026-73559] Denial of Service via unbounded completion prompt lists
Denial of Service via unbounded completion prompt lists. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-73558] Cross-User Data Leakage via Integer Overflow
Cross-User Data Leakage via Integer Overflow. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-190.