redhat has 2,798 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1490 in the last 90 days against 571 in the 90 before. The busiest recent month was October 2026 with 627. The median CVSS is 6.5 (medium), with 135 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (187) and CWE-787 (157). Most affected products: Red Hat Enterprise Linux 9 (275), Red Hat Enterprise Linux 10 (167), Linux (74).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1490 prev 571
Weakness classes
Products
- Red Hat Enterprise Linux 9 275
- Red Hat Enterprise Linux 10 167
- Linux 74
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2798 CVEsRSS
CVE-2026-88367Medium· 6.5PoCNanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization
NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding …
CVE-2026-88385Medium· 6.5PoCMini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing
Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control t…
CVE-2026-88384Medium· 5.5PoCOpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path
OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL…
CVE-2026-88383Medium· 6.2PoClibical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind()
libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an inco…
CVE-2026-90959High· 8.1A path traversal vulnerability was found in pulpcore
A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme valida…
CVE-2026-88360High· 7.5PoC⚖ disputedlibvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images
libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly…
CVE-2026-88359Medium· 6.5PoClibfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format()
libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer…
CVE-2026-95521High· 7.8A command injection flaw was found in rpm
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating th…
CVE-2026-95519High· 7.8A flaw was found in rpm
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest …
CVE-2026-94416Medium· 6.8An authorization bypass was found in the Ansible Automation Platform (AAP) gateway
An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not…
CVE-2026-97311Medium· 4.3A flaw was found in the Admin REST API of Keycloak, an identity and access management solution
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This…
CVE-2026-97185High· 7.8A flaw was found in GIMP
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting me…
CVE-2026-97177Medium· 6.6A flaw was found in the user update mechanism of the Keycloak Admin REST API
A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. Thi…
CVE-2026-97176Medium· 4.2A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution
A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an act…
CVE-2026-75887High· 7.5A flaw was found in the OpenShift console
A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to r…
CVE-2026-75886High· 7.2A flaw was found in openshift/console
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows t…
CVE-2026-96889High· 7.8PoCA flaw was found in librsvg
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly fre…
CVE-2026-85475High· 7.2A flaw was found in the Ansible Automation Platform automation controller
A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and …
CVE-2026-84724Medium· 6.6An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem
An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation def…
CVE-2026-84721Medium· 6.4A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend
A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the …
CVE-2026-84720Medium· 6.5A flaw was found in the Ansible Automation Platform automation-controller
A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in preve…
CVE-2026-84719Critical· 9.9A flaw was found in the Ansible Automation Platform automation-controller
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node a…
CVE-2026-84718Medium· 4.3A flaw was found in the Ansible Automation Platform automation-controller
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it ori…
CVE-2026-84717Medium· 5.3A flaw was found in the Ansible Automation Platform automation-controller
A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target…
CVE-2026-84716Medium· 6.6A flaw was found in the automation-controller instance install-bundle endpoint
A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X…
CVE-2026-84714High· 7.1A flaw was found in the automation-controller input-validation guard sanitize_jinja()
A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop a…
CVE-2026-84713Medium· 6.5A flaw was found in the automation-controller notification subsystem
A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is…
CVE-2026-84712Medium· 5.3A flaw was found in the automation-controller API
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data in…
CVE-2026-84706High· 7.6A flaw was found in Ansible Automation Platform's automation-controller
A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that om…
CVE-2026-75884Critical· 9.1A flaw was found in AWX
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service…