Red Hat Linux Security Advisories & Vulnerabilities
15906 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-59939] Denial of Service via unbounded decompression of HTTP response bodies
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0. This unbounded decompression can lead to a Denial of Service (DoS) by causing the client application to run out of memory and crash. This Important vulnerability in `httplib2` allows a remote attacker to trigger a Denial of Service (DoS) in client applications. By sending a specially crafted, compressed HTTP response, a malicious server can cause the client to exhaust its memory due to unbounded decompression, leading to application crashes. This poses a significant risk to Red Hat products that use `httplib2` to process untrusted HTTP content. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-409.
High [CVE-2026-59820] Directory traversal via crafted skill archive upload
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whose allowed_routes includes /v1/skills, anthropic_routes, or llm_api_routes to upload a crafted skill archive containing path traversal entries that could be written outside the intended extraction or staging directory. This issue is fixed in version 1.83.7-stable. A flaw was found in LiteLLM, a proxy server for Large Language Model (LLM) APIs. This vulnerability could lead to arbitrary file creation or modification, potentially resulting in system compromise. Exploitation requires the LiteLLM Proxy Server's Skills API (/v1/skills, anthropic_routes, or llm_api_routes) to be enabled and reachable by an authenticated caller. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Weakness: CWE-22. Affected Red Hat products: Exploit Intelligence. Red Hat lists Lightspeed Core; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI) as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-59821] Arbitrary code execution and information disclosure via custom code guardrails
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable. A flaw was found in LiteLLM, a proxy server for Large Language Model (LLM) APIs. The flaw allowed the user to submit custom Python code that would execute within the LiteLLM proxy environment, potentially exposing sensitive information or secrets accessible to the process. Red Hat rates this flaw with higher severity than the upstream GitHub Security Advisory (GHSA-72m8-9m7m-h278, CVSS v4.0 2.1, Low). Red Hat scored this CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2, Important) because a successful exploit grants arbitrary Python code execution within the LiteLLM proxy process, resulting in full compromise of the confidentiality, integrity, and availability of that component, including exposure of any secrets accessible to the process.
High [CVE-2026-14362] HashiCorp memberlist: Denial of Service via push/pull state handling
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0. This flaw results in a Denial of Service (DoS). Only Red Hat products that run the affected component as a live memberlist gossip agent (a process that binds and listens on a UDP/TCP gossip port for cluster membership) are exposed to this denial-of-service issue. Products that pull in github.com/hashicorp/memberlist only as a transitive Go dependency, without starting a gossip listener, do not exercise the vulnerable push/pull state-handling code path and are not affected. Grafana links github.com/hashicorp/memberlist solely for its optional unified-alerting high-availability (HA) clustering feature; the gossip listener only starts when unified_alerting.ha_peers (plus ha_listen_address/ha_advertise_address) is explicitly configured. Red Hat Advanced Cluster Management for Kubernetes ships its acm-grafana component with unified alerting disabled by default (unified_alerting.enabled = false) and never sets ha_peers, so it never starts the gossip listener and does not exercise the vulnerable code path; it is not affected.
High [CVE-2026-59892] @opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0. Successful exploitation of this flaw can terminate a Node.js process, resulting in a Denial of Service (DoS). This flaw affects the @opentelemetry/propagator-jaeger package used by container images that configure the Jaeger trace-context propagator. Red Hat CVSS score (7.5, Important) is consistent with upstream and NVD scoring. Weakness: CWE-248. Affected Red Hat products: Red Hat Developer Hub 1.10; Red Hat Developer Hub 1.9; Self-service automation portal 2. Red Hat lists OpenShift Serverless as not affected. Red Hat fixing advisory: RHSA-2026:49642, RHSA-2026:52768.
High [CVE-2026-39822] Go os.Root: Symlink following vulnerability allows directory traversal
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root. Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in `os.Root` with such a path, the symbolic link is improperly followed, potentially leading to access to locations outside of the defined root directory. This could result in information disclosure or unauthorized file system access. A flaw was found in Go's os.Root implementation. This is because `openat()` with `O_NOFOLLOW` does not prevent symlink resolution when the path has a trailing /. An attacker able to create symlinks within an os.Root directory could use this to read or write files outside the intended root. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. The following symbols are affected: * `OpenInRoot`: Opens a file or directory within an `os.Root`. * `Root. Create`: Creates a file inside an `os.Root`. * `Root. Open`: Opens a path relative to an `os.Root`. * `Root.
High [CVE-2026-59725] Denial of Service via invalid binary POST requests
Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7. A flaw was found in Socket.IO, specifically within the Engine.IO protocol v4 polling transport. This improper handling of requests prevents the HTTP response from being properly closed, which can lead to the exhaustion of server-side connections and sockets. The primary consequence is a Denial of Service (DoS), making the affected service unavailable to legitimate users. This flaw has been rated as Important. This can lead to server-side connection exhaustion and a denial of service, impacting the availability of applications utilizing Socket.IO. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-772. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3. Will not fix / out of support: Red Hat Enterprise Linux AI (RHEL AI) 3. Red Hat fixing advisory: RHSA-2026:37577, RHSA-2026:42986.
High [CVE-2026-59724] Denial of Service via crafted WebTransport session ID
Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7. A flaw was found in Engine.IO. This can lead to a TypeError, resulting in a denial of service (DoS) for the server. This vulnerability impacts the availability of the service. This flaw has been rated as Important. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-843. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3. Will not fix / out of support: Red Hat Enterprise Linux AI (RHEL AI) 3. Red Hat fixing advisory: RHSA-2026:26994.
High [CVE-2026-59877] Denial of Service via crafted.proto schema
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted.proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6. A remote attacker could exploit this vulnerability by providing a specially crafted.proto schema. This leads to a Denial of Service (DoS), making the affected system unresponsive. The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-835. Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Enterprise Linux 10; Red Hat Ansible Automation Platform 2.1; Red Hat Ansible Automation Platform 2.2; and 15 more.
High [CVE-2026-59874] Denial of Service via malformed tar archive header
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive. This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-606. Affected products named by the advisory: Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; and 29 more.
High [CVE-2026-59873] Denial of Service via crafted gzip bomb
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable. This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library's archive processing to craft a gzip bomb. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected products named by the advisory: Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; and 32 more. Affected products named by the advisory: Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Ansible Automation Platform 2.2; Red Hat Migration Toolkit 1.8; Red Hat OpenShift AI 2.25; and 28 more.
High [CVE-2026-59868] Denial of Service via quadratic CPU time parsing with merge keys
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in version 5.2.0. This can lead to a significant increase in CPU time required to parse the document, resulting in a Denial of Service (DoS) for the affected system. js-yaml versions 5.0.0 through 5.1.x are vulnerable to a denial of service. This can be triggered via yaml.load() on untrusted YAML input that uses merge keys. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1333. Affected Red Hat products: Red Hat Discovery 2; Red Hat Hardened Images.
High [CVE-2026-59869] Denial of Service via crafted YAML documents
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system. This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-606. Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat Ansible Automation Platform 2.5 for RHEL 8; and 44 more.
High [CVE-2026-59870] Denial of Service via crafted YAML ordered-map document
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the!!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1. An attacker could exploit this by providing a specially crafted YAML ordered-map document. This could lead to excessive CPU consumption, resulting in a denial of service (DoS) for applications processing the malicious YAML input. This affects yaml.load() calls using that schema. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Hardened Images; Red Hat Discovery 2.
High [CVE-2026-44918] Prevent rehoming resources to nodes with different owner
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. An authenticated project manager can change the node associated with Volume Connectors or Volume Target objects, potentially changing the project permitted to access the object. Volume Connectors contain secrets in environments configuring boot from volume with iSCSI volumes. Additionally, a project manager with the ability to create nodes can use the UUID of a node not owned by their project as a parent node when creating a new node. This mismatched child node can then be used to impact operations on the parent, such as forcing it to power on. The Red Hat Product Security team has assessed the severity of this vulnerability as Important. An authenticated project manager can reparent Volume Connectors and Volume Targets to nodes in a different project, crossing project authorization boundaries and potentially exposing iSCSI secrets used for boot-from-volume configurations. However, exploitation requires the 'manager' role, which is not a default role in OpenStack and must be explicitly granted by an administrator. The attacker must also know the UUID of the target node in the other project.
High [CVE-2026-55874] Information disclosure via S3 API gateway path traversal
SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34. The vulnerability results in unauthorized information disclosure across storage buckets. Important: This flaw in SeaweedFS allows an authenticated attacker to bypass intended access controls within the S3 API gateway. This could lead to unauthorized information disclosure in Red Hat Cryostat deployments utilizing SeaweedFS for storage. Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Cryostat 4 on RHEL 9. Red Hat fixing advisory: RHSA-2026:68333.
High [CVE-2026-60002] Use-after-free vulnerability during host key re-exchange on the client side
ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.) A flaw was found in OpenSSH. This could lead to high impact on confidentiality and integrity, and low impact on availability. Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat OpenShift Container Platform 4.19; Red Hat OpenShift Container Platform 4.20; Red Hat OpenShift Container Platform 4.21; Red Hat OpenShift Container Platform 4.22; Red Hat AI Inference Server 3.2; Red Hat AI Inference Server 3.5; Red Hat Hardened Images; Red Hat OpenShift AI 3.0; Red Hat OpenShift AI 3.2; Red Hat OpenShift AI 3.4; Red Hat OpenShift AI 3.5; Red Hat Update Infrastructure 5. Affected products named by the advisory: Red Hat package: openssh.
High [CVE-2026-59999] OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options
In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled. This Moderate severity flaw in OpenSSH `sshd` allows `PermitTunnel=yes` to override `DisableForwarding=yes`, potentially bypassing intended security controls. In Red Hat environments where `DisableForwarding` is used to restrict SSH session capabilities, an attacker who compromises a user's session could still establish a tunnel, leading to unauthorized network access or data exfiltration. This bypass occurs even when administrators explicitly attempt to prevent forwarding, though `PermitTunnel` is not enabled by default. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-358. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; and 11 more.
High [CVE-2026-55999] glamor Font Atlas Heap Buffer Overflow
Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a heap buffer overflow via SetFont due to missing glyph boundary checks. A flaw was found in the glamor_font_get() function of the xorg-x11-server. This vulnerability, a heap buffer overflow, occurs when the server processes a specially crafted PCF font file where individual glyph metrics exceed the declared maximum bounds. An authenticated X client can exploit this by loading a malicious font and drawing text, potentially leading to arbitrary code execution with attacker-controlled content and extent. This affects servers utilizing the glamor acceleration backend, such as Xorg with the modesetting driver and Xwayland. This Important flaw in xorg-x11-server allows an authenticated X client to achieve arbitrary code execution. This vulnerability primarily impacts Red Hat systems running Xorg with the modesetting driver or Xwayland, typically found in desktop environments. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-805.
High [CVE-2026-56001] BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow
A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont A flaw was found in libXfont2. In the BitmapScaleBitmaps() function, an integer overflow can occur when calculating the memory needed for font glyphs. This overflow leads to a heap buffer overflow, where a smaller-than-required memory buffer is allocated. A local attacker can exploit this by loading a specially crafted PCF font, potentially leading to arbitrary code execution or a denial of service. This flaw in libXfont2 is rated as Important. A local attacker could exploit an integer overflow in the `BitmapScaleBitmaps()` function, leading to a heap buffer overflow and potential arbitrary code execution or denial of service. This vulnerability requires the processing of a specially crafted PCF font, typically through an X server or an application configured to load untrusted font files. Red Hat severity: Important — CVSS 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 8 more.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.