redhat has 2,682 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1491 in the last 90 days against 554 in the 90 before. The busiest recent month was October 2026 with 628. The median CVSS is 6.6 (medium), with 132 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (173) and CWE-787 (152). Most affected products: Red Hat Enterprise Linux 9 (281), Red Hat Enterprise Linux 10 (167), Linux (72).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.6
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1491 prev 554
Weakness classes
Products
- Red Hat Enterprise Linux 9 281
- Red Hat Enterprise Linux 10 167
- Linux 72
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2682 CVEsRSS
CVE-2026-98603Low· 2.5kernel: kernel: Denial of service via race condition in ovpn (CVE-2026-98603)
A flaw was found in the Linux kernel's OpenVPN (ovpn) module. A local user can cause a Denial of Service (DoS) or network disruption during concurrent network traffic when an outdated local source address is cleared. Because the address is…
CVE-2026-98595Low· 3.3kernel: udp: remove a disconnected socket from the 4-tuple hash table (CVE-2026-98595)
A flaw was found in the Linux kernel's UDP networking subsystem. When a connected User Datagram Protocol (UDP) socket bound to a specific address is disconnected, the kernel fails to remove the socket entry from its internal connection loo…
CVE-2026-98597Medium· 6.5kernel: net: usb: sr9700: include receive overhead in the length check (CVE-2026-98597)
A flaw was found in the Linux kernel's sr9700 USB Ethernet driver. When processing incoming packets, the driver fails to properly account for packet header overhead during buffer length validation. An attacker capable of sending crafted pa…
CVE-2026-98596Medium· 5.5kernel: ipv6: Fix dst leak for uncached routes (CVE-2026-98596)
A flaw was found in the Linux kernel's IPv6 networking subsystem. A race condition during network device unregistration can lead to improper reference counting of uncached routes. A local attacker could exploit this flaw to cause an intern…
CVE-2026-98598Medium· 4.7kernel: ipv6: Prevent rt6_insert_exception() for dying fib6_info (CVE-2026-98598)
A flaw was found in the Linux kernel's IPv6 networking subsystem. A local attacker or network traffic triggering route exceptions while an IPv6 route is being removed can cause a circular reference leak. This failure to release resources p…
CVE-2026-98599Medium· 6.7kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() (CVE-2026-98599)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. A local attacker can exploit this flaw to cause kernel memory corruption and potentially achieve privilege escalation or a denial of service (system crash). This…
CVE-2026-98612Medium· 6.8kernel: net: usb: catc: bound the RX packet length in catc_rx_done() (CVE-2026-98612)
A flaw was found in the Linux kernel's CATC USB Ethernet driver. The driver fails to properly validate packet length boundaries when processing incoming multi-packet network transfers. An attacker could exploit this flaw by providing craft…
CVE-2026-98610Medium· 5.5kernel: net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget (CVE-2026-98610)
A flaw was found in the Linux kernel's Hierarchical Fair Service Curve (HFSC) network packet scheduler. A local user with network administration privileges, such as within a user namespace, can exploit this flaw to cause a Denial of Servic…
CVE-2026-98611Medium· 4.4kernel: bpf: Check params size before reading reserved fields (CVE-2026-98611)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The bpf_crypto_ctx_create() function attempts to read reserved fields from a parameter structure prior to verifying that the supplied buffer is sufficiently lar…
CVE-2026-98617Medium· 4.1kernel: eth: fbnic: use the Rx queue napi pointer to find the napi vector (CVE-2026-98617)
A flaw was found in the Linux kernel's Meta Host Network Interface (fbnic) driver. The driver incorrectly associates receive queues with network processing vectors and fails to verify whether the datapath is active before allocating queue …
CVE-2026-98614High· 7.5kernel: sctp: avoid livelock while updating retransmit path (CVE-2026-98614)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. An attacker could exploit this vulnerability to cause a Denial of Service (DoS) by triggering an infinite loop during retransmission path selecti…
CVE-2026-98613Medium· 4.4kernel: bpf: Bound ownership depth through local kptrs and graph roots (CVE-2026-98613)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local user with permissions to load BPF programs can trigger a Denial of Service (DoS) by creating deeply nested or cyclical object references using local ker…
CVE-2026-98616Medium· 4.1kernel: eth: fbnic: reset num_napi when the napi vectors are freed (CVE-2026-98616)
A flaw was found in the Linux kernel's fbnic driver. This flaw allows a local user to trigger a kernel crash, resulting in a Denial of Service (DoS). During power management suspend or failed resume operations, the driver frees interrupt v…
CVE-2026-98615Medium· 4.4kernel: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox (CVE-2026-98615)
A flaw was found in the Linux kernel's fbnic network driver. A local user with administrative privileges could trigger a Denial of Service (DoS) by initiating a reset or teardown of the firmware mailbox. Because the driver fails to properl…
CVE-2026-98639Medium· 5.8kernel: kernel: Incorrect TLB flushing in RISC-V KVM via improper nested acceleration update order (CVE-2026-98639)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the RISC-V architecture. During nested virtualization acceleration, control flags are written before the target page parameters are properly committed …
CVE-2026-98642Medium· 4.7kernel: kernel: Denial of Service via race condition in BPF memory allocator (CVE-2026-98642)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) memory allocator. A race condition occurs when bulk memory allocation and memory cleanup run concurrently without adequate synchronization. A local attacker could exploit …
CVE-2026-98650Medium· 4.7kernel: kernel: Denial of Service via race condition in s390 KVM storage key handling (CVE-2026-98650)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the s390 architecture. A race condition occurs when storage key management functions process large memory pages that are simultaneously split by anothe…
CVE-2026-112046Medium· 5.5org.ow2.asm/asm: OW2 ASM: Denial of Service via infinite loop in Label.resolve() (CVE-2026-112046)
A flaw was found in OW2 ASM. An attacker can cause a Denial of Service (DoS) by supplying a specially crafted Java class file with methods that grow beyond 64 kilobytes during transformation. When processing this file, an offset truncation…
CVE-2026-112062Medium· 5.9PoClwip: lwIP: Denial of Service via stack buffer overflow in mDNS response handling (CVE-2026-112062)
A flaw was found in lwIP. An adjacent attacker on the local network can cause a Denial of Service (DoS) by sending specially crafted multicast Domain Name System (mDNS) responses with invalid domain names or record lengths. Processing thes…
CVE-2026-112063Medium· 5.9PoClibstrophe: libstrophe: Denial of Service via oversized SCRAM salt (CVE-2026-112063)
A flaw was found in libstrophe. A malicious XMPP (Extensible Messaging and Presence Protocol) server can exploit a stack-based buffer overflow in the SCRAM (Salted Challenge Response Authentication Mechanism) authentication handler by send…
CVE-2026-89096Medium· 5.9Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocat…
CVE-2026-89085Medium· 6.6PoCParted: parted: heap-based buffer overflow via crafted fat32 filesystem image
A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user …
CVE-2026-89088Medium· 5.5PoCParted: parted: denial of service via heap buffer overflow during fat16 resize
A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malfo…
CVE-2026-62439High· 7.0PoCGimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker ca…
CVE-2026-62438Medium· 6.1Gimp: gimp: paa integer overflow out-of-bounds read
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an int…
CVE-2026-17591Low· 3.6Libarchive: libarchive: use-after-free via aliased mac metadata copy
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issu…
CVE-2026-111802Medium· 6.6Nautilus: nautilus: arbitrary file deletion via trash symlink
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this…
CVE-2026-110752High· 7.5Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before …
CVE-2026-110754Medium· 6.5Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the …
CVE-2026-110758High· 7.5Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted …