Red Hat has 2,307 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1635 in the last 90 days against 356 in the 90 before. The busiest recent month was October 2026 with 789. The median CVSS is 6.5 (medium), with 98 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-125 (150) and CWE-787 (135). Most affected products: Red Hat Enterprise Linux 9 (339), Red Hat Enterprise Linux 10 (191), Linux (82).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 1635 prev 356
Weakness classes
Products
- Red Hat Enterprise Linux 9 339
- Red Hat Enterprise Linux 10 191
- Linux 82
- Red Hat OpenShift AI (RHOAI) 64
- Chrome 61
- Red Hat Enterprise Linux BaseOS (v. 10) 60
Worst active — by depth score
CVE-2024-11394High· 8.8transformers: Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11394)74CVE-2024-11393High· 8.8transformers: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11…74CVE-2026-4631Critical· 9.8Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization69CVE-2026-92183High· 7.8gimp: gimp: Arbitrary code execution via stack-based buffer overflow in APNG parser (CVE-2026-92183)68CVE-2024-11392High· 7.5transformers: Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11392)68
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2307 CVEsRSS
CVE-2026-98873Low· 3.3kernel: netfilter: nf_conntrack_expect: zero at allocation time (CVE-2026-98873)
A flaw was found in the Linux kernel's Netfilter connection tracking subsystem. Memory allocated for tracking expected network connections was not properly cleared upon allocation. A local user could exploit this vulnerability by querying …
CVE-2026-98871Medium· 4.1kernel: crypto: ccp - Fix possible deadlock in SEV init failure path (CVE-2026-98871)
A flaw was found in the Linux kernel's AMD Cryptographic Coprocessor (CCP) driver. This vulnerability can lead to a Denial of Service (DoS) due to a deadlock during AMD Secure Encrypted Virtualization (SEV) platform initialization. When an…
CVE-2026-98876Medium· 4.1kernel: host1x: bus: Fix missing ops null check in error teardown (CVE-2026-98876)
A flaw was found in the Linux kernel's Host1x bus driver. This vulnerability can lead to a Denial of Service (DoS) by causing a system crash. During device initialization error handling, the driver attempts to access client operations with…
CVE-2026-98874Low· 2.3kernel: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect (CVE-2026-98874)
A flaw was found in the Linux kernel's iwlwifi driver. A local user can trigger an unintended kernel warning by configuring Wake on Wireless LAN (WoWLAN) and suspending the system while disconnected from a network. On systems configured to…
CVE-2026-98872Medium· 4.4kernel: freevxfs: don't BUG() on unknown typed-extent type (CVE-2026-98872)
A flaw was found in the Linux kernel's FreeVxFS filesystem driver. When encountering an unrecognized extent type in an on-disk structure, the driver triggers a fatal kernel panic instead of handling the error cleanly. A local user can expl…
CVE-2026-98877Medium· 4.7kernel: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed (CVE-2026-98877)
A flaw was found in the Linux kernel's ARM Generic Interrupt Controller (GIC) driver. When virtual interrupt support is enabled on a system lacking an Interrupt Translation Service (ITS) controller, the kernel fails to disable virtual inte…
CVE-2026-98875Medium· 4.4kernel: drm/nouveau/gsp: add SEC2 to GA100 chip table (CVE-2026-98875)
A flaw was found in the Linux kernel's Nouveau GPU driver. During graphics hardware initialization on systems with GA100 chipsets, the driver fails to properly configure an internal security processor entry, leaving a required pointer unin…
CVE-2026-55889Medium· 5.3⚖ disputedxdg-desktop-portal: xdg-desktop-portal: unauthorized data disclosure via predictable token generation (CVE-2026-55889)
A flaw was found in xdg-desktop-portal. The service uses a predictable pseudorandom number generator (PRNG) to generate authorization tokens that manage access to shared system resources. By requesting enough tokens to determine the intern…
CVE-2026-55888High· 8.2xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames (CVE-2026-55888)
A flaw was found in xdg-desktop-portal. An attacker operating a sandboxed application can bypass isolation boundaries to gain unauthorized access to host files. This issue occurs because the FileChooser interface fails to properly validate…
CVE-2026-115730Low· 3.1i18next-http-backend: i18next-http-backend: Cross-site scripting via protocol-relative URL injection (CVE-2026-115730)
A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirect…
CVE-2026-115485Medium· 6.3Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a…
CVE-2026-115484High· 7.6Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same n…
CVE-2026-115486High· 7.1Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated uncond…
CVE-2026-115449Low· 3.5Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch …
CVE-2026-115221Medium· 5.4Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership
A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by mat…
CVE-2026-114645Medium· 5.2mongo-c-driver: mongo-c-driver: Denial of Service via integer wraparound in Windows authentication (CVE-2026-114645)
A flaw was found in mongo-c-driver. An integer wraparound in the Windows-native Kerberos authentication code can occur when an excessively long credential value is supplied in the client connection configuration. An attacker capable of mod…
CVE-2026-115417High· 7.5aws-c-mqtt: aws-c-mqtt: Denial of Service via excessive memory allocation (CVE-2026-115417)
A flaw was found in aws-c-mqtt. A remote attacker can cause a Denial of Service (DoS) in client applications due to improper memory allocation handling within the MQTT (Message Queuing Telemetry Transport) compatibility adapter. By trigger…
CVE-2026-115504High· 7.8cfitsio: cfitsio: arbitrary code execution via crafted FITS file (CVE-2026-115504)
A flaw was found in cfitsio. An attacker could exploit this vulnerability by enticing a user or automated system to process a specially crafted Flexible Image Transport System (FITS) file. Due to improper bounds checking when handling vari…
CVE-2026-115378Medium· 5.8github.com/lxc/incus: Incus: Arbitrary file write on the host via recursive file pull (CVE-2026-115378)
A flaw was found in Incus. A privileged attacker within a virtual machine can write arbitrary files to the host system during a recursive file pull operation. By manipulating the guest agent to return duplicate file entries alternating bet…
CVE-2026-115373Medium· 6.3github.com/lxc/incus: Incus: Information disclosure via missing authorization check in operations endpoint (CVE-2026-115373)
A flaw was found in Incus. A missing authorization check on the operations endpoint allows an authenticated attacker with restricted project access to view operations belonging to other projects. By querying the endpoint with a known opera…
CVE-2026-115374High· 7.1github.com/lxc/incus: incus: Information disclosure via unsigned headers in presigned S3 URLs (CVE-2026-115374)
A flaw was found in Incus. The built-in Simple Storage Service (S3) server does not properly verify request signatures, allowing an attacker with a presigned upload URL to inject unsigned request headers. By supplying an unauthorized copy …
CVE-2026-115372High· 8.5github.com/lxc/incus: Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options (CVE-2026-115372)
A flaw was found in Incus. This vulnerability allows an authenticated attacker with restricted project permissions to achieve privilege escalation to administrative (root) level on the host system. By specifying custom creation options dur…
CVE-2026-115365Medium· 6.6github.com/openbao/openbao: OpenBao: Privilege escalation via ACL policy cache namespace traversal (CVE-2026-115365)
A flaw was found in OpenBao. An authenticated attacker can bypass authorization boundaries by assigning specially crafted policy names to tokens, allowing the tokens to reference cached Access Control List (ACL) policies from other namespa…
CVE-2026-115354Medium· 6.5mistune: mistune: Information disclosure via path traversal in Include directive (CVE-2026-115354)
A flaw was found in mistune. When the opt-in Include directive is enabled, insufficient path validation allows an attacker to perform path traversal by supplying relative or absolute file paths. An attacker who submits crafted Markdown inp…
CVE-2026-115351Medium· 4.7mistune: mistune: Information disclosure via CSS injection in figure directive (CVE-2026-115351)
A flaw was found in mistune. A remote attacker with control over markdown content can cause information disclosure by performing Cascading Style Sheets (CSS) injection through the unvalidated figwidth option in the figure directive. By ins…
CVE-2026-115350Medium· 6.1mistune: mistune: Cross-site scripting via Include directive (CVE-2026-115350)
A flaw was found in mistune. An attacker can exploit this vulnerability to conduct stored Cross-Site Scripting (XSS) attacks through the file inclusion directive. By referencing a crafted HTML file, unescaped content is processed as raw ma…
CVE-2026-97631High· 8.8edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)
A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service…
CVE-2026-115319Low· 2.5github.com/junegunn/fzf: fzf: Denial of Service via inefficient string concatenation (CVE-2026-115319)
A flaw was found in fzf. Inefficient string concatenation in the maskActionContents function allows a local attacker to cause a Denial of Service (DoS). By repeatedly sending large HTTP requests to the local server, an attacker can block t…
CVE-2026-114348Medium· 5.3webpack-dev-server: webpack-dev-server: Information disclosure via malformed Host header (CVE-2026-114348)
A flaw was found in webpack-dev-server. An unauthenticated remote attacker can exploit improper Host header validation in the open-editor endpoint to obtain sensitive technical information. By sending a request with a specially crafted Hos…
CVE-2026-115207Medium· 5.5Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during auto…