Red Hat has 2,310 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1637 in the last 90 days against 356 in the 90 before. The busiest recent month was October 2026 with 791. The median CVSS is 6.5 (medium), with 99 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-125 (150) and CWE-787 (135). Most affected products: Red Hat Enterprise Linux 9 (339), Red Hat Enterprise Linux 10 (191), Linux (82).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 1637 prev 356
Weakness classes
Products
- Red Hat Enterprise Linux 9 339
- Red Hat Enterprise Linux 10 191
- Linux 82
- Red Hat OpenShift AI (RHOAI) 64
- Chrome 61
- Red Hat Enterprise Linux BaseOS (v. 10) 60
Worst active — by depth score
CVE-2024-11394High· 8.8transformers: Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11394)74CVE-2024-11393High· 8.8transformers: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11…74CVE-2026-92183High· 7.8gimp: gimp: Arbitrary code execution via stack-based buffer overflow in APNG parser (CVE-2026-92183)68CVE-2026-4631Critical· 9.8Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization68CVE-2024-11392High· 7.5transformers: Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11392)68
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2310 CVEsRSS
CVE-2026-116497Medium· 5.5Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon
A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no a…
CVE-2026-92171Medium· 6.5Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line argumen…
CVE-2026-116124High· 7.8libgsf: libgsf: Arbitrary code execution via heap-based buffer overflow in OLE2 parser (CVE-2026-116124)
A flaw was found in libgsf. A heap-based buffer overflow vulnerability exists in the OLE2 document parser within the ole_info_read_metabat function. A remote attacker could exploit this flaw by enticing a user to open a specially crafted f…
CVE-2026-116137Low· 3.7adm-zip: adm-zip: File integrity check bypass via duplicate archive entries (CVE-2026-116137)
A flaw was found in adm-zip. A remote attacker can exploit this issue by providing a specially crafted ZIP archive containing duplicate entries with equivalent path names to bypass validation checks. Consequently, an application may inspec…
CVE-2026-116141Medium· 5.3ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder (CVE-2026-116141)
A flaw was found in ImageMagick. A remote attacker could cause a Denial of Service (DoS) through excessive resource consumption by submitting a specially crafted Ultra High Dynamic Range (UHDR) image file. Because the UHDR decoder validate…
CVE-2026-116140Low· 3.3ImageMagick: ImageMagick: Security policy bypass via flawed delegate invocation parsing (CVE-2026-116140)
A flaw was found in ImageMagick. An attacker could bypass administrator-defined security policies by convincing the application to process specially crafted input that triggers a delegate invocation. This issue occurs due to incorrect pars…
CVE-2026-116149High· 7.8ImageMagick: ImageMagick: Memory corruption via crafted bzip2 compressed images (CVE-2026-116149)
A flaw was found in ImageMagick. A stack-based buffer overflow vulnerability exists in the handling of bzip2 compressed images, where stack memory can be overwritten during decoding. By submitting a specially crafted image, an attacker can…
CVE-2026-116148Low· 3.6ImageMagick: ImageMagick: Command injection via unvalidated drawing options in MVG encoder (CVE-2026-116148)
A flaw was found in ImageMagick. The Magick Vector Graphics (MVG) encoder does not properly neutralize user-specified drawing options before writing them into generated output. An attacker capable of supplying drawing options can exploit t…
CVE-2026-116152Medium· 5.3ImageMagick: ImageMagick: Denial of Service via memory leak in MAT decoder (CVE-2026-116152)
A flaw was found in ImageMagick. An attacker could exploit this issue by providing a specially crafted MAT image file that triggers an error-handling path where allocated memory is not properly released. Over time, repeated processing of t…
CVE-2026-116153Low· 2.5ImageMagick: ImageMagick: Denial of Service via heap-based buffer overflow in convex-hull calculations (CVE-2026-116153)
A flaw was found in ImageMagick. An attacker could exploit this vulnerability to cause a Denial of Service (DoS) or potentially execute arbitrary code on 32-bit systems. By convincing a user or automated service to process a specially craf…
CVE-2026-116160Low· 3.3ImageMagick: ImageMagick: Denial of Service via crafted image in X11 animate operation (CVE-2026-116160)
A flaw was found in ImageMagick. An attacker can cause a Denial of Service (DoS) by tricking a user into processing a specially crafted image file using the X11 animate feature. Processing the image triggers a heap-based buffer overflow, w…
CVE-2026-116172Medium· 5.9vllm: vLLM: Denial of Service via improper input validation in Rust gRPC interface (CVE-2026-116172)
A flaw was found in vLLM. Due to improper input validation in the Rust gRPC interface, a remote attacker can bypass configured limits by sending requests with excessively large or wrapped token count values. When processed, these invalid v…
CVE-2026-116174Medium· 5.9vllm: vllm: Denial of Service via invalid prompt token IDs in gRPC service (CVE-2026-116174)
A flaw was found in vLLM. A remote attacker can trigger a Denial of Service (DoS) by submitting requests containing out-of-bounds token identifiers to the gRPC service. Because the application fails to validate pre-tokenized input against …
CVE-2026-116177High· 7.5vllm: vllm: Denial of Service via unconstrained image decompression (CVE-2026-116177)
A flaw was found in vLLM. This flaw allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting system memory. The vulnerability occurs because the Nemotron-VL processor modules disable the global maximum ima…
CVE-2026-116176High· 8.2vllm: vllm: Information disclosure via SSRF in X-Request-Id header (CVE-2026-116176)
A flaw was found in vLLM. This vulnerability allows a remote attacker to trigger a Server-Side Request Forgery (SSRF) by submitting an HTTP request containing a crafted X-Request-Id header. Because the application extracts network addresse…
CVE-2026-116181Medium· 6.5vllm: vllm: Denial of Service via unvalidated stop token identifiers (CVE-2026-116181)
A flaw was found in vllm. An authenticated remote attacker could cause a Denial of Service (DoS) or memory corruption by submitting requests containing invalid stop token identifiers. Because the application does not verify whether provide…
CVE-2026-116192Medium· 5.9github.com/rclone/rclone: rclone: Information disclosure via Server-Side Request Forgery in rc-serve (CVE-2026-116192)
A flaw was found in rclone. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery (SSRF). When the rc-serve feature is enabled, an attacker can provide a double-sla…
CVE-2026-116190Low· 3.7github.com/rclone/rclone: rclone: Information disclosure via cross-host HTTP redirects (CVE-2026-116190)
A flaw was found in rclone. When interacting with WebDAV storage services, rclone inadvertently forwards user-configured custom credential headers to external destinations across HTTP redirects. A remote attacker who controls or influences…
CVE-2026-116196Medium· 5.3github.com/rclone/rclone: rclone: Information disclosure via HTTP redirects in B2 backend (CVE-2026-116196)
A flaw was found in Rclone. This vulnerability allows information disclosure due to improper handling of HTTP redirects within the Backblaze B2 storage backend. When download requests are redirected, the client inadvertently forwards sensi…
CVE-2026-116194Medium· 6.8github.com/rclone/rclone: rclone: Sensitive data disclosure via CSRF in pCloud OAuth callback (CVE-2026-116194)
A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery (CSRF) vulnerability in the pCloud storage backend. During authorization, the local authentica…
CVE-2026-116189High· 7.5github.com/rclone/rclone: rclone: Arbitrary code execution via self-update signature verification bypass (CVE-2026-116189)
A flaw was found in rclone. A remote attacker with the ability to tamper with the release distribution path can bypass cryptographic signature verification during the self-update process. By prepending an unsigned checksum before the signe…
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
A flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement a…
CVE-2026-106071Low· 3.6PoCnodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radi…
CVE-2026-106072Medium· 6.7PoCnodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
A flaw was found in Node.js TLS hostname verification. When a client connects using a non-canonical IPv4 hostname spelling (for example 0177.0.0.1, 0x7f.0.0.1, 2130706433, or 127.1), tls.checkServerIdentity() may fail to classify the host …
CVE-2026-106073Low· 3.3PoCnodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
A flaw was found in the Node.js Permission Model. fs.realpathSync() does not perform the filesystem read permission checks required of comparable fs APIs. This is an incomplete fix of CVE-2026-21715, which only covered fs.realpathSync.nati…
CVE-2026-106070Low· 3.7PoCnodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch (CVE-2026-106070)
A flaw was found in the Node.js zlib.ZipFile API. After local and central ZIP header validation fails, reading zipEntry.modified (directly or while compacting) can leave a parsed local header cached without a content offset. A later conten…
CVE-2026-106074Medium· 4.8PoCnodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
A flaw was found in Node.js crypto. Internal entropy caches used by crypto.randomUUID(), crypto.randomUUIDv7(), and crypto.randomInt() can be saved into user-land startup snapshots (--build-snapshot) and single executable applications buil…
CVE-2026-105481Medium· 6.5PoCnodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
A flaw was found in Node.js. The HTTP Agent keep-alive connection reuse logic can cause a client to treat data that arrived on an idle socket before a new request was sent as the response to that request. The guard that destroys idle keep-…
CVE-2026-115754Medium· 4.7serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization (CVE-2026-115754)
A flaw was found in serialize-javascript. This vulnerability allows an attacker to conduct cross-site scripting (XSS) attacks by supplying crafted function source text containing unescaped script closing tags. When serialized into a web pa…
CVE-2026-98870Medium· 6.5⚖ disputedkernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) server. A remote attacker could trigger this vulnerability by establishing and terminating bound SMB channels, leaving stale connection references attached to active s…