Red Hat Linux Security Advisories & CVEs
5652 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-88004] Security bypass and identity spoofing via unsanitized request trailers
Security bypass and identity spoofing via unsanitized request trailers. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-444. Affected product named by the advisory: Red Hat OpenShift Dev Spaces.
Medium [CVE-2026-88914] integer overflow and out-of-bounds read in qtdemux CEA-608 closed-caption parser
integer overflow and out-of-bounds read in qtdemux CEA-608 closed-caption parser. Red Hat rates this moderate (CVSS 4.4). Weakness: CWE-190. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: gstreamer1-plugins-good; Red Hat package: gstreamer-plugins-good.
Medium [CVE-2026-88884] Security control bypass via digest updates
Security control bypass via digest updates. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-807.
Medium [CVE-2026-88883] Information disclosure of TLS private keys via incomplete log sanitization
Information disclosure of TLS private keys via incomplete log sanitization. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-117.
Medium [CVE-2026-84828] non-root haclient users can read arbitrary files via pcs host auth --token
non-root haclient users can read arbitrary files via pcs host auth --token. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-732. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; and 3 more. Affected products named by the advisory: Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat package: pcs.
Medium [CVE-2026-88859] javascript execution via spoofed vCard control bypasses mail script-markup restriction
javascript execution via spoofed vCard control bypasses mail script-markup restriction. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-84. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: evolution.
Medium [CVE-2026-61915] VPATCH BYPARAM double-free in CalDAV
VPATCH BYPARAM double-free in CalDAV. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-415. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: cyrus-imapd.
Medium [CVE-2026-61911] Sieve fileinto mailbox existence oracle
Sieve fileinto mailbox existence oracle. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-497. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: cyrus-imapd.
Medium [CVE-2026-61910] Mailbox/set let sharee change special-use role on shared mailboxes
Mailbox/set let sharee change special-use role on shared mailboxes. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-863. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: cyrus-imapd.
Medium [CVE-2026-61909] CalDAV/CardDAV multiget bypasses per-href ACL
CalDAV/CardDAV multiget bypasses per-href ACL. Red Hat rates this moderate (CVSS 5). Weakness: CWE-420. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: cyrus-imapd.
Medium [CVE-2026-61908] JMAP email-header blob ID out-of-bounds index
JMAP email-header blob ID out-of-bounds index. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: cyrus-imapd.
Medium [CVE-2026-88763] Unbounded recursion in AMQP field parser leads to denial of service
Unbounded recursion in AMQP field parser leads to denial of service. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-674. Affected product named by the advisory: Red Hat Service Interconnect 2.
Medium [CVE-2026-57822] Unsafe deserialization via JsonUtil CompositeData on management address
Unsafe deserialization via JsonUtil CompositeData on management address. Red Hat rates this moderate (CVSS 4.9). Weakness: CWE-502. Red Hat lists fixing advisory RHSA-2026:66488 with package artemis-core-client. Affected products named by the advisory: Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; and 1 more. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 8.
Medium [CVE-2026-49363] Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0
Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-306. Red Hat lists fixing advisory RHSA-2026:66488 with package eap8-jackson-annotations-0:2.18.9-1.redhat_00003.1.el10eap, eap8-jbossws-cxf-0:7.4.0-1.Final_redhat_00001.1.el8eap, eap8-wildfly-0:8.1.8-9.GA_redhat_00006.1.el9eap, eap8-parsson-0:1.1.9-1.redhat_00001.1.el10eap. Affected products named by the advisory: Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8; and 1 more. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform Expansion Pack.
Medium [CVE-2026-93561] Memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling
Memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling. Red Hat rates this important (CVSS 6.5). Weakness: CWE-1035. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat Single Sign-On 7.
Medium [CVE-2026-93493] OCSP Validation Silently Skipped When a Response Omits the Optional nextUpdate Field
OCSP Validation Silently Skipped When a Response Omits the Optional nextUpdate Field. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-299. Affected product named by the advisory: Red Hat build of Apache Camel for Spring Boot 4.
Medium [CVE-2026-88264] /dev/console symlink follow allows root-owned file creation outside the rootfs
/dev/console symlink follow allows root-owned file creation outside the rootfs. Red Hat rates this moderate (CVSS 5.6). Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:71668 with package crun-main-1.30-1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2026-88770] Device Authorization Grant issues tokens to brute-force-locked accounts
Device Authorization Grant issues tokens to brute-force-locked accounts. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-307. Affected products named by the advisory: Red Hat Build of Keycloak; Red Hat Single Sign-On 7.
Medium [CVE-2026-83530] Denial of Service via uncontrolled memory allocation
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced. A flaw was found in cel-go. A user can trigger a Denial of Service (DoS) by submitting an expression that exceeds the configured parser expression size limit. Because memory is allocated proportional to the input length before the limit is validated, processing oversized inputs causes uncontrolled memory consumption. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-770. Affected Red Hat products: Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-87872] OCAPI module_utils (ocapi_command, ocapi_info) hardcode validate_certs=False with no override, enabling TLS man-in-the-middle and credential disclosure
OCAPI module_utils (ocapi_command, ocapi_info) hardcode validate_certs=False with no override, enabling TLS man-in-the-middle and credential disclosure. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-295. Affected products named by the advisory: Red Hat Ceph Storage 5; Red Hat Ceph Storage 9; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.