Red Hat Linux Security Advisories & CVEs
15368 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-17670] Use after free in Views
Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Weakness: CWE-825.
High [CVE-2026-17666] Cryptographic Flaw in Enterprise
Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. (Chromium security severity: High) A cryptographic flaw flaw was found in the Enterprise component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-347.
High [CVE-2026-17659] Inappropriate implementation in SiteIsolation
Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). Weakness: CWE-653.
High [CVE-2026-17658] Use after free in V8
Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) An use after free flaw was found in the V8 component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-825.
High [CVE-2026-17661] Use after free in Loader
Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) An use after free flaw was found in the Loader component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-825.
High [CVE-2026-17657] Use after free in Navigation
Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Weakness: CWE-825.
High [CVE-2026-17654] Race in Updater
Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Critical) A race flaw was found in the Updater component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Critical — CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-367.
High [CVE-2026-18378] cluster pull-secret token exfiltration via user-controlled api_url (SSRF / confused deputy)
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token. Red Hat severity: Important — CVSS 7.6 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N). Weakness: CWE-918. Affected Red Hat products: Cost Management Metrics Operator. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-18381] operator service-account token exfiltration via user-controlled Prometheus service_address
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token. Red Hat severity: Important — CVSS 7.6 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N). Weakness: CWE-918. Affected Red Hat products: Cost Management Metrics Operator. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-63362] Denial of Service via unsigned integer underflow
An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet. A flaw was found in open62541. This vulnerability could make the affected system unavailable to legitimate users. This Moderate severity flaw in open62541 can lead to a denial of service. The high attack complexity associated with this vulnerability reduces the likelihood of successful exploitation. This component is only present in Fedora. Red Hat does not ship this component in any core Red Hat products. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-191.
Medium [CVE-2026-68563] Information disclosure of PostgreSQL data via insecure backup permissions
A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure. The vulnerability occurs when a specific Leapp remediation task, intended to back up and remove old PostgreSQL data, creates a world-readable archive in `/var/backups`. Exploitation requires local access to a managed node where this particular remediation workflow has been executed and `/var/lib/pgsql/data` existed. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-732. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: ansible-collection-redhat-leapp.
Medium [CVE-2026-68562] Information disclosure via Leapp report tampering
A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials. When an operator subsequently runs the `leapp_corrupted_grubenv_file` remediation, the Ansible controller may be tricked into disclosing sensitive controller-local files to the compromised managed node, crossing a trust boundary. Exploitation depends on both prior compromise of the managed node and specific operator action. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N). Weakness: CWE-610. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: ansible-collection-redhat-leapp.
Medium [CVE-2026-67550] Denial of Service via out-of-bounds read
Denial of Service via out-of-bounds read. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-125.
Medium [CVE-2026-59881] Denial of Service via unnegotiated WebSocket compression
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2. A flaw was found in AIOHTTP. The WebSocket client in AIOHTTP processes compressed data frames even when the compression mechanism, known as permessage-deflate, has not been properly negotiated. A malicious server can exploit this by sending specially crafted compressed frames. This can lead to unexpected and excessive consumption of the system's central processing unit (CPU) and memory, potentially resulting in a denial of service (DoS) for legitimate users. Red Hat rates this flaw as Moderate with a CVSS score of 5.3 because exploitation requires an aiohttp WebSocket client to connect to an attacker-controlled server. In typical Red Hat product deployments, aiohttp serves as an HTTP client library for internal service communication rather than establishing WebSocket connections to untrusted endpoints. The resulting resource consumption is limited to the individual process running the affected client and does not propagate to other services or the host system. Weakness: CWE-409.
Medium [CVE-2026-12996] Denial of Service or memory leak via crafted packets
A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry A flaw was found in OpenVPN. Successful exploitation of this flaw could lead to a denial of service, making the service unavailable, or result in a memory leak, potentially exposing sensitive information. Moderate impact. While it can lead to a denial of service or memory leak, the need for prior authentication limits the attack vector, making it less severe than unauthenticated vulnerabilities. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-825.
Medium [CVE-2026-11771] Denial of Service via crafted NTLM proxy response
OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server A flaw was found in OpenVPN. A remote attacker could exploit an off-by-one buffer write vulnerability during NTLM (NT LAN Manager) proxy authentication. By sending a specially crafted NTLM response from a malicious proxy server, the attacker could cause the OpenVPN client to crash, leading to a denial of service. Exploitation requires a client to connect through a malicious NTLM proxy server, which can then send a specially crafted response. The necessity of user interaction with a compromised proxy limits the overall risk. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-787.
Medium [CVE-2026-13117] Denial of service or memory leakage via incomplete TLS guard
An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage A flaw was found in OpenVPN. This can lead to a denial of service, making the service unavailable, or memory leakage, which could potentially expose sensitive information. The high attack complexity and requirement for prior authentication limit the immediate risk, but successful exploitation could disrupt VPN services or expose sensitive information. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-825.
Medium [CVE-2026-60074] Date::Manip: Incorrect date parsing leads to logic errors
Date::Manip: Incorrect date parsing leads to logic errors. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-681.
Medium [CVE-2026-7260] Denial of Service via circular symbolic links in phar archives
Denial of Service via circular symbolic links in phar archives. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-606. Red Hat lists fixing advisory RHSA-2026:47200 with package php-main-8.5.9-1.hum1.
Medium [CVE-2026-18369] ACME HTTP-01 validation SSRF via IP literal identifiers and unvalidated redirects
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error. Red Hat rates this Moderate because exploitation is limited to HTTP GET requests (no integrity impact), the attacker cannot read internal responses on production-supported backends (low confidentiality impact), and the ACME responder must be explicitly deployed. The Scope is Changed (S:C) because the ACME responder causes the Dogtag server to make outbound requests to services outside its own trust boundary, but the actual information gained on supported configurations is limited to network topology probing. While the SSRF is GET-only and does not directly allow data modification, administrators should be aware that internal services reachable from the Dogtag host which perform actions on HTTP GET (such as cloud instance metadata endpoints that issue temporary credentials) could be indirectly affected.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.