Red Hat Linux Security Advisories & CVEs
11399 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-76781] Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS). This Moderate flaw in libxml2's XML catalog parsing can lead to a denial of service. The vulnerability requires user interaction, as a specially crafted XML catalog with a missing `catalog` attribute in a `nextCatalog` element must be processed by an application using libxml2, causing it to crash. This limits the attack surface to scenarios where an attacker can provide malicious XML input to a vulnerable application. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Hardened Images as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2026:57604. Affected products named by the advisory: Red Hat package: libxml2; Red Hat package: podman.
Medium [CVE-2026-81829] Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver
Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22. Affected products named by the advisory: Exploit Intelligence; Red Hat build of Apicurio Registry 3; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack.
Medium [CVE-2026-92963] Sensitive information disclosure due to internal state access
Sensitive information disclosure due to internal state access. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-767.
Medium [CVE-2026-92952] Sandbox Symbol Filtering Bypass leading to Host Stream State Corruption
Sandbox Symbol Filtering Bypass leading to Host Stream State Corruption. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-184. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-92949] Sandbox bypass allows unauthorized data modification.
Sandbox bypass allows unauthorized data modification. Red Hat rates this moderate (CVSS 4). Weakness: CWE-807. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-92945] Module allowlist bypass allows access to restricted packages
Module allowlist bypass allows access to restricted packages. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-1025. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-92936] Information Disclosure via Error Stack Formatting
Information Disclosure via Error Stack Formatting. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-497. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-92933] Information Disclosure via util.getCallSites
Information Disclosure via util.getCallSites. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-497. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-92973] Cross-Site Scripting via OSC 8 hyperlink handling
Cross-Site Scripting via OSC 8 hyperlink handling. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79. Affected product named by the advisory: Red Hat Ansible Automation Platform 2.
Medium [CVE-2026-92904] Job output readable without object-level view_job_invocations check
Job output readable without object-level view_job_invocations check. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-863. Affected product named by the advisory: Red Hat Satellite 6.
Medium [CVE-2026-92382] unbounded iso_packet_desc index in usbredirhost_iso_packet leads to heap out-of-bounds write
unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write. Red Hat rates this moderate (CVSS 4.1). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: usbredir.
Medium [CVE-2026-92894] Unscoped LookupValue deletion allows cross-model override value destruction
Unscoped LookupValue deletion allows cross-model override value destruction. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-863. Affected product named by the advisory: Red Hat Satellite 6.
Medium [CVE-2026-90982] @fastify/static: @fastify/static: Information disclosure via route guard bypass on case-insensitive filesystems
@fastify/static: @fastify/static: Information disclosure via route guard bypass on case-insensitive filesystems. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-178.
Medium [CVE-2026-92893] Ansible inventory API ignores view_hosts permission filters, exposes hidden parameters
Ansible inventory API ignores view_hosts permission filters, exposes hidden parameters. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-863. Affected product named by the advisory: Red Hat Satellite 6.
Medium [CVE-2026-93159] atmel-sha204a - fix heap info leak on I2C transfer failure
atmel-sha204a - fix heap info leak on I2C transfer failure. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-459.
Medium [CVE-2026-93056] remove broken string configfs attributes
remove broken string configfs attributes. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476.
Medium [CVE-2026-93116] fix resource leaks on probe failure
fix resource leaks on probe failure. Red Hat rates this low (CVSS 5.5). Weakness: CWE-772. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: kernel-rt.
Medium [CVE-2026-93136] Fix device refcount leak in the error path of MHI device creation
Fix device refcount leak in the error path of MHI device creation. Red Hat rates this low (CVSS 5.5). Weakness: CWE-911. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: kernel-rt.
Medium [CVE-2026-93072] Fix generic interrupt chip leak on remove
Fix generic interrupt chip leak on remove. Red Hat rates this low (CVSS 5.5). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat package: kernel-rt.
Medium [CVE-2026-90119] Fix the card leak at probe error with the auto-cleanup
Fix the card leak at probe error with the auto-cleanup. Red Hat rates this low (CVSS 5.5). Weakness: CWE-772. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat package: kernel-rt.