Red Hat Linux Security Advisories & CVEs
11137 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-57177] Login Cross-Site Request Forgery via missing state validation in LoginRadius backend
Login Cross-Site Request Forgery via missing state validation in LoginRadius backend. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-358. Affected product named by the advisory: Red Hat Ansible Automation Platform 2.
Medium [CVE-2026-57176] Account takeover via Vend user ID collision
Account takeover via Vend user ID collision. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-694. Affected product named by the advisory: Red Hat Ansible Automation Platform 2.
Medium [CVE-2026-57175] Account takeover via unverified SAML responses
Account takeover via unverified SAML responses. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-303. Affected product named by the advisory: Red Hat Ansible Automation Platform 2.
Medium [CVE-2026-94281] Denial of Service via out-of-bounds read in XListInputDevices
Denial of Service via out-of-bounds read in XListInputDevices(). Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:71839 with package libxi-main-1.8.3-2.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libxi.
Medium [CVE-2026-93544] Denial of Service via out-of-bounds read in XIQueryDevice reply parsing
Denial of Service via out-of-bounds read in XIQueryDevice reply parsing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:71839 with package libxi-main-1.8.3-2.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libxi.
Medium [CVE-2026-93543] Denial of Service via out-of-bounds read in XI2 class parser
Denial of Service via out-of-bounds read in XI2 class parser. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:71839 with package libxi-main-1.8.3-2.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libxi.
Medium [CVE-2026-93542] Denial of Service via out-of-bounds read during XI2 class parsing
Denial of Service via out-of-bounds read during XI2 class parsing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:71839 with package libxi-main-1.8.3-2.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libxi.
Medium [CVE-2026-93541] Out-of-bounds read in libXi's XQueryDeviceState
Out-of-bounds read in libXi's XQueryDeviceState(). Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:71839 with package libxi-main-1.8.3-2.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: libxi.
Medium [CVE-2026-97058] Denial of Service via unbounded precision specifiers
Denial of Service via unbounded precision specifiers. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-1284. Affected products named by the advisory: Gatekeeper 3; Migration Toolkit for Applications 8; Multicluster Engine for Kubernetes; Node HealthCheck Operator; and 46 more. Affected products named by the advisory: OpenShift Pipelines; OpenShift Service Mesh 3; Red Hat 3scale API Management Platform 2; Red Hat Advanced Cluster Management for Kubernetes 2; and 42 more.
Medium [CVE-2026-94416] authorization bypass via workload identity token forgery
authorization bypass via workload identity token forgery. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-290. Affected product named by the advisory: Red Hat Ansible Automation Platform 2.
Medium [CVE-2026-97311] CVE-2026-97311
CVE-2026-97311. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-79680] Authentication bypass via RFB protocol violation
Authentication bypass via RFB protocol violation. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-358.
Medium [CVE-2026-97177] Generic user update bypasses denied reset-password permission
Generic user update bypasses denied reset-password permission. Red Hat rates this moderate (CVSS 6.6). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-97176] Essential acr requirement silently bypassed via Cookie authenticator
Essential acr requirement silently bypassed via Cookie authenticator. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-862. Affected product named by the advisory: Red Hat Build of Keycloak.
Medium [CVE-2026-97149] unauthorized read of other objects via TempURL and X-Copy-From
unauthorized read of other objects via TempURL and X-Copy-From. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-358. Affected products named by the advisory: Red Hat OpenStack Platform 13 (Queens); Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Medium [CVE-2026-95622] Reachable assertion in Cell Broadcast encoding parse causes denial of service
Reachable assertion in Cell Broadcast encoding parse causes denial of service. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-617.
Medium [CVE-2026-88372] Denial of Service via integer overflow in mat4_read_header
Denial of Service via integer overflow in mat4_read_header(). Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-190. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat package: libsndfile.
Medium [CVE-2026-88384] Denial of Service via crafted EXR file
Denial of Service via crafted EXR file. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat package: openexr.
Medium [CVE-2026-88383] Denial of Service via crafted iCalendar property parsing
Denial of Service via crafted iCalendar property parsing. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-843. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: libical.
Medium [CVE-2026-88386] Denial of Service via misaligned memory access during WAV parsing
Denial of Service via misaligned memory access during WAV parsing. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-843. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat package: libsndfile.