Red Hat Linux Security Advisories & CVEs
5482 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-95507] out-of-bounds read in NC-SI OEM response handler discloses host memory to guest
out-of-bounds read in NC-SI OEM response handler discloses host memory to guest. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-125.
Medium [CVE-2026-74765] Net::IDN::Punycode: Net::IDN::Punycode: Information disclosure or denial of service via integer overflow
Net::IDN::Punycode: Net::IDN::Punycode: Information disclosure or denial of service via integer overflow. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125.
Medium [CVE-2026-95516] heap-buffer-overflow write in Structured-Append QR text extraction
heap-buffer-overflow write in Structured-Append QR text extraction. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-787.
Medium [CVE-2026-88340] Memory corruption and denial of service via specially crafted rule files
Memory corruption and denial of service via specially crafted rule files. Red Hat rates this moderate (CVSS 5). Weakness: CWE-763. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: yara.
Medium [CVE-2026-88341] Denial of Service via crafted compiled rule file
Denial of Service via crafted compiled rule file. Red Hat rates this moderate (CVSS 5). Weakness: CWE-617. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: yara.
Medium [CVE-2026-75432] Sensitive information disclosure via scanner component
Sensitive information disclosure via scanner component. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-201.
Medium [CVE-2026-79312] Missing session ID rotation after authentication leads to session fixation
Missing session ID rotation after authentication leads to session fixation. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-384.
Medium [CVE-2026-79311] Missing autoescape in render_jinja leads to Cross-Site Scripting (XSS)
Missing autoescape in render_jinja leads to Cross-Site Scripting (XSS). Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79.
Medium [CVE-2026-94572] HAProxy configuration injection via tls_ciphers on pools and listeners
HAProxy configuration injection via tls_ciphers on pools and listeners. Red Hat rates this moderate (CVSS 5). Weakness: CWE-94. Affected products named by the advisory: Red Hat OpenStack Platform 13 (Queens); Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Medium [CVE-2026-93433] Denial of Service via stack buffer overflow in SCSI VPD page parsing
Denial of Service via stack buffer overflow in SCSI VPD page parsing. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-121. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: libstoragemgmt.
Medium [CVE-2026-94571] HAProxy configuration injection via L7 policy redirect_url and redirect_prefix
HAProxy configuration injection via L7 policy redirect_url and redirect_prefix. Red Hat rates this moderate (CVSS 5). Weakness: CWE-94. Affected products named by the advisory: Red Hat OpenStack Platform 13 (Queens); Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Medium [CVE-2026-94215] Cross-realm client read/write via request-level cache missing realm ownership check
Cross-realm client read/write via request-level cache missing realm ownership check. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-94213] Authorization Services policy evaluation endpoint leaks user identity
Authorization Services policy evaluation endpoint leaks user identity. Red Hat rates this moderate (CVSS 4.9). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-96544] integer overflow in the PVR image loader leads to an out-of-bounds heap read
integer overflow in the PVR image loader leads to an out-of-bounds heap read. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-190.
Medium [CVE-2026-94001] Admin credential DELETE bypasses denied reset-password permission
Admin credential DELETE bypasses denied reset-password permission. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-94000] Delegated admin with manage-users can escalate to realm-admin via group membership
Delegated admin with manage-users can escalate to realm-admin via group membership. Red Hat rates this moderate (CVSS 6.6). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-93999] Token refresh continues issuing tokens for disabled audience clients
Token refresh continues issuing tokens for disabled audience clients. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-93981] Cross-Site Scripting via Unescaped Strings
Cross-Site Scripting via Unescaped Strings. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:71906 with package grafana13-1-main-13.1.6-0.6.hum1, grafana12-4-main-12.4.10-0.10.hum1, grafana13-2-main-13.2.1-0.7.hum1, grafana13-1-main-13.1.6-0.5.hum1. Affected products named by the advisory: Red Hat Hardened Images; Migration Toolkit for Applications 8; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; and 3 more. Affected products named by the advisory: Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Dev Spaces; Red Hat package: grafana.
Medium [CVE-2026-93562] Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling
Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1035. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; and 8 more. Affected products named by the advisory: Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; Red Hat Build of Keycloak; Red Hat Data Grid 8; and 4 more.
Medium [CVE-2026-93574] HTTP request smuggling via post-digit whitespace in chunk-size parsing
HTTP request smuggling via post-digit whitespace in chunk-size parsing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-444. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; and 8 more. Affected products named by the advisory: Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; Red Hat Build of Keycloak; Red Hat Data Grid 8; and 4 more.