Red Hat Linux Security Advisories & CVEs
3195 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-64653] Path traversal via unescaped URL variables
Path traversal via unescaped URL variables. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-22.
Medium [CVE-2026-43630] Information disclosure via out-of-bounds read
Information disclosure via out-of-bounds read. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125.
Medium [CVE-2026-70639] Denial of Service in Android JNI wrapper via malicious model file
Denial of Service in Android JNI wrapper via malicious model file. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476.
Medium [CVE-2025-49506] Information disclosure via timing attack in password validation
Information disclosure via timing attack in password validation. Red Hat rates this low (CVSS 5.9). Weakness: CWE-208. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: apr-util.
Medium [CVE-2026-32327] Denial of Service via XML stack recursion attack
Denial of Service via XML stack recursion attack. Red Hat rates this moderate (CVSS 6.2). Weakness: CWE-776.
Medium [CVE-2026-57818] Authorization Code Replay via Race Condition
Authorization Code Replay via Race Condition. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-639. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat JBoss Web Server 5.
Medium [CVE-2026-68079] Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider
Authorization code replay due to flaw in DefaultEncryptingCodeDataProvider. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-613. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat JBoss Web Server 5.
Medium [CVE-2026-68481] Revocation bypass allows unauthorized access
Revocation bypass allows unauthorized access. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-303. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat JBoss Web Server 5.
Medium [CVE-2026-18967] SAML OneTimeUse assertion replay in IdP-Initiated broker flow
SAML OneTimeUse assertion replay in IdP-Initiated broker flow. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-294. Affected products named by the advisory: Red Hat Build of Keycloak; Red Hat JBoss Enterprise Application Platform Expansion Pack.
Medium [CVE-2026-19028] Denial of Service via integer underflow in Fletcher32 filter
Denial of Service via integer underflow in Fletcher32 filter. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images.
Medium [CVE-2026-19027] Information disclosure and denial of service via crafted HDF5 file
Information disclosure and denial of service via crafted HDF5 file. Red Hat rates this moderate (CVSS 5.6). Weakness: CWE-125.
Medium [CVE-2026-19026] Denial of service via crafted HDF5 file
Denial of service via crafted HDF5 file. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images.
Medium [CVE-2026-19025] Denial of Service due to malformed chunk data in files
Denial of Service due to malformed chunk data in files. Red Hat rates this moderate (CVSS 5). Weakness: CWE-369. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images.
Medium [CVE-2026-19024] Denial of service via malformed dataset
Denial of service via malformed dataset. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Affected product named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3.
Medium [CVE-2026-71313] Path Traversal allows arbitrary file write
Path Traversal allows arbitrary file write. Red Hat rates this moderate (CVSS 6.9). Weakness: CWE-22. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
Medium [CVE-2026-71311] FTP command injection via CRLF in filename encoding
FTP command injection via CRLF in filename encoding. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-93.
Medium [CVE-2026-71310] Denial of Service via unbounded HTTP CONNECT response headers
Denial of Service via unbounded HTTP CONNECT response headers. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.
Medium [CVE-2026-70429] Privilege escalation via inconsistent case sensitivity in user and group names
Privilege escalation via inconsistent case sensitivity in user and group names. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-178. Affected product named by the advisory: OpenShift Developer Tools and Services.
Medium [CVE-2026-49331] unauthenticated identity header injection on whitelisted paths
unauthenticated identity header injection on whitelisted paths. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-345. Affected product named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2026-16100] Unbounded metric cardinality in user event metrics via request-controlled error text
Unbounded metric cardinality in user event metrics via request-controlled error text. Red Hat rates this moderate (CVSS 6.5). Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, keycloak-services, rhbk/keycloak-rhel9-operator:26.6-11.