Red Hat Linux Security Advisories & CVEs
10918 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-103885] Denial of Service via crafted telephone numbers
Denial of Service via crafted telephone numbers. Red Hat rates this important (CVSS 7.5). Weakness: CWE-835. Affected product named by the advisory: Red Hat Fuse 7.
High [CVE-2026-103877] org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Remote code execution via untrusted Java object deserialization
org.apache.directory.api/api-ldap-client-api: Apache Directory LDAP API: Remote code execution via untrusted Java object deserialization. Red Hat rates this important (CVSS 8.1). Weakness: CWE-502. Affected product named by the advisory: Red Hat Fuse 7.
High [CVE-2026-103552] org.apache.directory.api/api-ldap-codec-core: Apache Directory LDAP API: Denial of Service via deeply nested search filter
org.apache.directory.api/api-ldap-codec-core: Apache Directory LDAP API: Denial of Service via deeply nested search filter. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected product named by the advisory: Red Hat Fuse 7.
High [CVE-2026-102731] Denial of Service via excessive memory allocation
Denial of Service via excessive memory allocation. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected product named by the advisory: Red Hat Fuse 7.
High [CVE-2026-94635] Denial of Service via improper length parameter handling in Lua bindings
Denial of Service via improper length parameter handling in Lua bindings. Red Hat rates this important (CVSS 7.5). Weakness: CWE-130. Red Hat lists fixing advisory RHSA-2026:74369 with package thrift-main-0.25.0-0.1.hum1. Affected products named by the advisory: Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat Enterprise Linux AI (RHEL AI) 3; and 1 more. Affected products named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-104477] Cross-site scripting via unescaped double quotes in link and image attributes
Cross-site scripting via unescaped double quotes in link and image attributes. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79. Affected products named by the advisory: Multicluster Engine for Kubernetes; Node HealthCheck Operator; Red Hat 3scale API Management Platform 2; Red Hat Advanced Cluster Management for Kubernetes 2; and 5 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Virtualization 4; and 1 more.
Medium [CVE-2026-104874] Denial of Service via memory leak in items-view operations
Denial of Service via memory leak in items-view operations. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-911. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; OpenShift Lightspeed; and 11 more. Affected products named by the advisory: Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Ansible Automation Platform Ansible Core 2; Red Hat Discovery 2; and 7 more.
Medium [CVE-2026-104872] @opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-m…
@opentelemetry/instrumentation-cassandra-driver: @opentelemetry/instrumentation-knex: @opentelemetry/instrumentation-mongoose: @opentelemetry/instrumentation-mysql: @opentelemetry/instrumentation-mysql2: @opentelemetry/instrumentation-oracledb: @opentelemetry/instrumentation-pg: @opentelemetry/instrumentation-tedious: opentelemetry-js-contrib: Information disclosure via default database username emission in telemetry data. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-201. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-104855] Memory corruption via preemption checks during bulk operations
Memory corruption via preemption checks during bulk operations. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-1265. Affected products named by the advisory: Red Hat Connectivity Link 1; Red Hat Enterprise Linux 10; Red Hat package: tree-sitter; Red Hat package: virt-firmware-rs.
Medium [CVE-2026-104853] Arbitrary file write via path traversal in migration planning
Arbitrary file write via path traversal in migration planning. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-22.
Medium [CVE-2026-104844] Denial of Service via crafted CSS selectors
Denial of Service via crafted CSS selectors. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-606.
Medium [CVE-2026-94484] Denial of Service via response cache poisoning
Denial of Service via response cache poisoning. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-694. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Trusted Artifact Signer; Red Hat package: firefox; Red Hat package: thunderbird.
Medium [CVE-2026-94485] Information disclosure via unrestricted cross-site requests on development server
Information disclosure via unrestricted cross-site requests on development server. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-346. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Trusted Artifact Signer; Red Hat package: firefox; Red Hat package: thunderbird.
Medium [CVE-2026-94543] Response cache poisoning via improper route binding
Response cache poisoning via improper route binding. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-694. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Trusted Artifact Signer; Red Hat package: firefox; Red Hat package: thunderbird.
Medium [CVE-2026-94486] Information disclosure via unrestricted cross-site requests
Information disclosure via unrestricted cross-site requests. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-346. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Trusted Artifact Signer; Red Hat package: firefox; Red Hat package: thunderbird.
Medium [CVE-2026-49919] Integer overflow in FreeType tt_face_colr_blend_layer leads to heap buffer overflow during COLR font rendering
Integer overflow in FreeType tt_face_colr_blend_layer() leads to heap buffer overflow during COLR font rendering. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-190. Affected products named by the advisory: Red Hat build of OpenJDK 11 ELS; Red Hat build of OpenJDK 17; Red Hat build of OpenJDK 21; Red Hat build of OpenJDK 25; and 15 more. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 11 more.
Medium [CVE-2026-104721] Arbitrary file write via path traversal in MDC discriminator
Arbitrary file write via path traversal in MDC discriminator. Red Hat rates this moderate (CVSS 5.6). Weakness: CWE-22. Affected products named by the advisory: Migration Toolkit for Applications 8; OpenShift Serverless; Red Hat build of Apache Camel - HawtIO 4; Red Hat Ceph Storage 9; and 11 more. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 7 more.
Medium [CVE-2026-66331] Denial of Service via excessive resource allocation in Delphi buffered transport
Denial of Service via excessive resource allocation in Delphi buffered transport. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:74369 with package thrift-main-0.25.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; and 1 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3.
Medium [CVE-2026-94638] Denial of Service via uncontrolled resource allocation in PHP bindings
Denial of Service via uncontrolled resource allocation in PHP bindings. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:74369 with package thrift-main-0.25.0-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; and 1 more. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3.
Medium [CVE-2026-97876] Secure Boot lockdown bypass via improper serial address validation
Secure Boot lockdown bypass via improper serial address validation. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-822. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat package: grub2.