Red Hat Linux Security Advisories & CVEs
3067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-50021] Integrity bypass allows installation of altered packages via modified lockfile
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. This vulnerability is fixed in 10.34.0 and 11.4.0. This can lead to the execution of arbitrary code or other malicious activities on the system. This poses a significant risk in environments where both lockfile modification and registry control are possible, leading to potential arbitrary code execution. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-494. Affected Red Hat products: Red Hat Build of Keycloak. Red Hat lists Red Hat AMQ Broker 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-55700] Unauthorized file modification via crafted package manifest
Unauthorized file modification via crafted package manifest. Red Hat rates this important (CVSS 7.1). Weakness: CWE-22.
High [CVE-2026-55698] Arbitrary code execution via malicious package-manager lockfile
pnpm is a package manager. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained matching pnpm and @pnpm/exe versions. This vulnerability is fixed in 10.34.2 and 11.5.3. This can cause pnpm to install and execute attacker-controlled code during automatic version switching. This can lead to the execution of attacker-controlled code when pnpm is used to install dependencies from such a repository, posing a significant supply chain risk. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-502. Affected Red Hat products: Red Hat Build of Keycloak. Red Hat lists Red Hat AMQ Broker 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-55697] Arbitrary code execution via improper handling of config dependencies
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency as an install-engine opt-in. During install, pnpm resolved a platform-specific @pacquet/-/pacquet binary from node_modules/.pnpm-config/ and spawned it as the developer or CI user. This vulnerability is fixed in 10.34.2 and 11.5.3. A remote attacker could exploit this vulnerability by crafting a malicious repository that declares a configDependency in its pnpm-workspace.yaml file. When a user installs packages from this repository, pnpm improperly treats the declared dependency as an install-engine opt-in, leading to the execution of a malicious binary. This allows for arbitrary code execution on the system of the developer or continuous integration (CI) user. A remote attacker could exploit this by crafting a malicious repository that, when used by a developer or CI system, leads to the execution of a malicious binary. This vulnerability arises from pnpm's improper handling of `configDependencies` declared in `pnpm-workspace.yaml`, allowing an untrusted repository to opt into a native install engine. Affected product named by the advisory: Red Hat Build of Keycloak.
High [CVE-2026-55487] Supply chain compromise via manipulated package source strings
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator normalized to the same value. This vulnerability is fixed in 10.34.2 and 11.5.3. This vulnerability allows a remote attacker to bypass security checks by manipulating how package source strings are processed. By crafting a specially designed source string, an attacker could trick the system into approving and using a malicious package instead of the intended one. This could lead to the execution of unauthorized code or the installation of harmful software, severely impacting the confidentiality, integrity, and availability of the system. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-140. Affected Red Hat products: Red Hat Build of Keycloak. Red Hat lists Red Hat AMQ Broker 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-9099] Group-Admin Escalation to Realm-Admin
Group-Admin Escalation to Realm-Admin. Red Hat rates this important (CVSS 7.7). Weakness: CWE-639. Red Hat lists fixing advisory RHSA-2026:30049 with package rhbk/keycloak-operator-bundle:26.4.13-1, rhbk/keycloak-rhel9-operator:26.4-19, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9:26.6-8.
High [CVE-2026-9086] Cross-site scripting (XSS) via case-insensitive URI validation bypass
Cross-site scripting (XSS) via case-insensitive URI validation bypass. Red Hat rates this important (CVSS 7.3). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:30049 with package rhbk/keycloak-operator-bundle:26.4.13-1, rhbk/keycloak-rhel9-operator:26.4-19, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9:26.6-8.
High [CVE-2026-55693] Out-of-bounds Write in Spell File Word Count
Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted.spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653. Red Hat severity: Moderate — CVSS 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H). Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:30267.
High [CVE-2026-55895] Arbitrary code execution via Vimscript code injection in netrw plugin
Arbitrary code execution via Vimscript code injection in netrw plugin. Red Hat rates this important (CVSS 7.8). Weakness: CWE-94.
High [CVE-2026-57456] Arbitrary code execution via malicious docstrings in Python omni-completion
Arbitrary code execution via malicious docstrings in Python omni-completion. Red Hat rates this important (CVSS 7.8). Weakness: CWE-94. Red Hat lists fixing advisory RHSA-2026:35387 with package vim-main-9.2.780-1.hum1.
High [CVE-2026-12244] A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker controlled bytes.
A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker controlled bytes. Red Hat rates this important (CVSS 8). Weakness: CWE-787.
High [CVE-2026-12245] Denial of DNS over TLS service by any DoT client
Denial of DNS over TLS service by any DoT client. Red Hat rates this important (CVSS 7.5). Weakness: CWE-617.
High [CVE-2026-12246] Out of bounds stack write with crafted APL RR
Out of bounds stack write with crafted APL RR. Red Hat rates this important (CVSS 8). Weakness: CWE-787.
High [CVE-2026-53143] Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
Fix buffer overflow in SDMA queue checkpoint/restore on GFX11. Red Hat rates this important (CVSS 7). Weakness: CWE-131.
High [CVE-2026-53145] Try to fix change_handle ioctl, attempt 4
Try to fix change_handle ioctl, attempt 4. Red Hat rates this important (CVSS 7). Weakness: CWE-367.
High [CVE-2026-53148] Clamp XDomain response data copy to allocation size
Clamp XDomain response data copy to allocation size. Red Hat rates this important (CVSS 7). Weakness: CWE-787.
High [CVE-2026-53153] drain before clearing xarray entry on reparent
drain before clearing xarray entry on reparent. Red Hat rates this important (CVSS 7). Weakness: CWE-820.
High [CVE-2026-53175] fix use-after-free caused by the fqdir_pre_exit flush
fix use-after-free caused by the fqdir_pre_exit() flush. Red Hat rates this important (CVSS 7).
High [CVE-2026-53202] Fix signed integer truncation in IPC receive
Fix signed integer truncation in IPC receive. Red Hat rates this important (CVSS 7).
High [CVE-2026-53203] Add buffer overflow check in MS get_info_ioctl
Add buffer overflow check in MS get_info_ioctl. Red Hat rates this important (CVSS 7). Weakness: CWE-120.