Red Hat Linux Security Advisories & CVEs
3200 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-38755] Denial of Service via heap overflow in evalcommand function
Denial of Service via heap overflow in evalcommand() function. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:42074 with package busybox-main-1.37.0-8.2.hum1.
Medium [CVE-2026-38752] Denial of Service via crafted AWK script
Denial of Service via crafted AWK script. Red Hat rates this moderate (CVSS 6.5). Red Hat lists fixing advisory RHSA-2026:42074 with package busybox-main-1.37.0-8.2.hum1.
Medium [CVE-2026-59732] File overwrite via path traversal during archive extraction
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as../, allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in version 1.74.4. An attacker could craft a malicious archive that, when extracted by a user, allows files to be written outside the intended destination directory. This path traversal vulnerability could lead to the creation or overwrite of other files within the same storage location, potentially compromising data integrity. Red Hat ships rclone in the VolSync component of Red Hat Advanced Cluster Management for Kubernetes (RHACM). All shipped versions are affected by this path traversal vulnerability in rclone's archive extraction functionality. Exploitation requires a user to actively run `rclone archive extract` on an attacker-supplied malicious archive. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L). Weakness: CWE-22. Will not fix / out of support: Red Hat Advanced Cluster Management for Kubernetes 2. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-48125] Denial of Service via crafted Client Hints header
Denial of Service via crafted Client Hints header. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-1333.
Medium [CVE-2026-49476] Denial of Service via crafted CSS selector string
Denial of Service via crafted CSS selector string. Red Hat rates this important (CVSS 5.9). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:34119 with package python-rpds-py-main-2026.6.3-1.hum1, python-attrs-main-26.1.0-3.hum1.
Medium [CVE-2026-49854] Information disclosure via out-of-bounds read in websocket_mask
Information disclosure via out-of-bounds read in websocket_mask. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-125.
Medium [CVE-2026-15778] Insufficient validation of untrusted input in Navigation
Insufficient validation of untrusted input in Navigation. Red Hat rates this moderate (CVSS 4.6). Weakness: CWE-1289.
Medium [CVE-2026-15771] Insufficient validation of untrusted input in Media
Insufficient validation of untrusted input in Media. Red Hat rates this important (CVSS 5.3). Weakness: CWE-125.
Medium [CVE-2026-15770] Uninitialized Use in V8
Uninitialized Use in V8. Red Hat rates this important (CVSS 6.5). Weakness: CWE-824.
Medium [CVE-2026-49459] Cross-site scripting bypass allows arbitrary script execution
Cross-site scripting bypass allows arbitrary script execution. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-79.
Medium [CVE-2026-49458] Cross-site scripting due to improper sanitization of DOM nodes
Cross-site scripting due to improper sanitization of DOM nodes. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79.
Medium [CVE-2026-47423] Cross-site scripting vulnerability allows information disclosure
Cross-site scripting vulnerability allows information disclosure. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:10999 with package ruff-main-0.15.11-1.hum1.
Medium [CVE-2026-15714] Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string
Out-of-bounds read in soup_multipart_input_stream_read_headers via an oversized multipart boundary string. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125.
Medium [CVE-2026-15713] HTTP/2 frame window exhaustion remote denial of service via memory leak
HTTP/2 frame window exhaustion remote denial of service via memory leak. Red Hat rates this low (CVSS 5.9). Weakness: CWE-772.
Medium [CVE-2026-50659] .NET:.NET: Network Spoofing Vulnerability
.NET:.NET: Network Spoofing Vulnerability. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-838. Red Hat lists fixing advisory RHSA-2026:41895 with package dotnet8-0-main-8.0.129-2.1.hum1, dotnet9.0-0:9.0.119-1.el9_8, dotnet9.0-0:9.0.119-1.el8_10, dotnet9-0-main-9.0.119-1.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 1.
Medium [CVE-2026-15712] HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-termination assumption
HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-termination assumption. Red Hat rates this low (CVSS 5.9). Weakness: CWE-125.
Medium [CVE-2026-59888] com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records
com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-915.
Medium [CVE-2026-59884] Denial of Service via crafted BER input
Denial of Service via crafted BER input. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:40236 with package jaeger-main-2.19.0-1.1.hum1.
Medium [CVE-2026-59198] Information disclosure via TGA RLE encoder out-of-bounds read
Information disclosure via TGA RLE encoder out-of-bounds read. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125.
Medium [CVE-2026-59203] Denial of Service via crafted EPS file
Denial of Service via crafted EPS file. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-835.