Red Hat Linux Security Advisories & CVEs
5547 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-46581] com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include. Red Hat rates this important (CVSS 8.1). Weakness: CWE-94. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-68480] Safe RET Interrupt Vulnerability
Safe RET Interrupt Vulnerability. Red Hat rates this important (CVSS 8.8). Weakness: CWE-201. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-18649] unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders
unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-71498] Information disclosure via out-of-bounds read with malformed UTF-8 input
Information disclosure via out-of-bounds read with malformed UTF-8 input. Red Hat rates this moderate (CVSS 5.1). Weakness: CWE-125.
Medium [CVE-2026-71497] Cross-site scripting via malformed HTML tag names
Cross-site scripting via malformed HTML tag names. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-1289. Affected products named by the advisory: Cryostat 4; Migration Toolkit for Applications 8; OpenShift Developer Tools and Services; Red Hat AMQ Broker 7; and 12 more. Affected products named by the advisory: Red Hat build of Apache Camel - HawtIO 4; Red Hat build of Apicurio Registry 3; Red Hat build of Quarkus Native builder; Red Hat Enterprise Linux 10; and 8 more.
Medium [CVE-2026-61632] Information disclosure via path traversal in b64 extension
Information disclosure via path traversal in b64 extension. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22. Affected products named by the advisory: Red Hat Developer Hub; Red Hat OpenShift Container Platform 4; Self-service automation portal 2.
Medium [CVE-2026-71439] Denial of Service via Radar Diagrams 'ticks' parameter
Denial of Service via Radar Diagrams 'ticks' parameter. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1050.
Medium [CVE-2026-71438] Prototype pollution vulnerability via configuration APIs
Prototype pollution vulnerability via configuration APIs. Red Hat rates this moderate (CVSS 4). Weakness: CWE-915. Affected products named by the advisory: Red Hat Build of Podman Desktop; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Dev Spaces.
Medium [CVE-2026-50159] CSS injection allows altering page elements via diagram input
CSS injection allows altering page elements via diagram input. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-79.
Medium [CVE-2026-71437] Prototype pollution vulnerability allows potential arbitrary code execution
Prototype pollution vulnerability allows potential arbitrary code execution. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-915.
Medium [CVE-2026-64654] Terminal escape sequence injection allows command execution
Terminal escape sequence injection allows command execution. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-78.
Medium [CVE-2026-64653] Path traversal via unescaped URL variables
Path traversal via unescaped URL variables. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-22.
Medium [CVE-2026-32327] Denial of Service via XML stack recursion attack
Denial of Service via XML stack recursion attack. Red Hat rates this moderate (CVSS 6.2). Weakness: CWE-776.
Medium [CVE-2026-68481] Revocation bypass allows unauthorized access
Revocation bypass allows unauthorized access. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-303. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat JBoss Web Server 5.
Medium [CVE-2026-18967] SAML OneTimeUse assertion replay in IdP-Initiated broker flow
SAML OneTimeUse assertion replay in IdP-Initiated broker flow. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-294. Affected products named by the advisory: Red Hat Build of Keycloak; Red Hat JBoss Enterprise Application Platform Expansion Pack.
Critical [CVE-2026-10090] namespace edit user can deploy cluster-scoped ClusterRoleBinding and become cluster-admin via Application Subscription
namespace edit user can deploy cluster-scoped ClusterRoleBinding and become cluster-admin via Application Subscription. Red Hat rates this important (CVSS 9.9). Weakness: CWE-267. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
Critical [CVE-2026-10059] namespace admin can escalate to cluster-wide curator authority via ClusterCurator ServiceAccount token
namespace admin can escalate to cluster-wide curator authority via ClusterCurator ServiceAccount token. Red Hat rates this important (CVSS 9.1). Weakness: CWE-266. Affected product named by the advisory: Multicluster Engine for Kubernetes.
High [CVE-2026-71312] Server-Side Command Execution via Malicious SFTP Filenames
Server-Side Command Execution via Malicious SFTP Filenames. Red Hat rates this important (CVSS 8). Weakness: CWE-78.
High [CVE-2026-34966] Information disclosure via Server-Side Request Forgery (SSRF) bypass
Information disclosure via Server-Side Request Forgery (SSRF) bypass. Red Hat rates this important (CVSS 7.6). Weakness: CWE-918.
High [CVE-2026-71309] Backend Root Escape via Incomplete Path Validation
Backend Root Escape via Incomplete Path Validation. Red Hat rates this important (CVSS 8.1). Weakness: CWE-22.