Red Hat has 2,798 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1490 in the last 90 days against 571 in the 90 before. The busiest recent month was October 2026 with 627. The median CVSS is 6.5 (medium), with 135 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (187) and CWE-787 (157). Most affected products: Red Hat Enterprise Linux 9 (275), Red Hat Enterprise Linux 10 (167), Linux (74).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1490 prev 571
Weakness classes
Products
- Red Hat Enterprise Linux 9 275
- Red Hat Enterprise Linux 10 167
- Linux 74
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2798 CVEsRSS
CVE-2026-19872Medium· 6.1HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into…
HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message. The wrappers and renderers that emit a form's errors interpolate the error string straight into…
CVE-2026-80219High· 8.7Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
CVE-2026-78234Critical· 9.9A flaw was found in hawtio-operator
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author o…
CVE-2026-77968High· 8.2A flaw was found in hawtio-operator
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the Ser…
CVE-2026-74860High· 8.5A flaw was found in libxml2 with Python bindings enabled
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This…
CVE-2026-74859Medium· 6.8The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths
The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside ~/.themes by using ../ path traversal, absolute paths, or…
CVE-2026-76561High· 7.2A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Admi…
CVE-2026-86404High· 8.8EAP's Artemis deserialization configuration permits deserialization by default
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() met…
CVE-2026-86332Medium· 6.5A flaw was found in odh-dashboard in Red Hat OpenShift AI
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data,…
CVE-2026-18355High· 7.5A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base)
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, …
CVE-2026-16028High· 7.5Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table. When a stream reaches the CLOSED state, stream_state returns the concurrency slot…
Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table. When a stream reaches the CLOSED state, stream_state returns the concurrency slot…
CVE-2026-86469Medium· 5.3PoCA flaw was found in GLib2
A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation …
CVE-2026-76560High· 7.5A flaw was found in 389 Directory Server
A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access contr…
CVE-2026-19843High· 8.4PoCA flaw was found in 389-ds-base
A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated…
CVE-2026-18922Critical· 9.8A flaw was found in 389 Directory Server
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, a stale identity carried in a Cyrus SASL auxiliary property from a prior failed bind attempt can be installed on a connection following a subsequent, unrelated s…
CVE-2026-18453High· 7.5A flaw was found in 389 Directory Server
A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests …
CVE-2026-79678High· 8.1A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated…
CVE-2026-76578Critical· 9.8PoCA flaw was found in FreeIPA
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a r…
CVE-2026-86289Medium· 4.3PoCA vulnerability was found in Ollama up to 0.31.1
A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible t…
CVE-2026-86250High· 7.5⚖ disputedh3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk…
CVE-2026-80791Medium· 4.3kernel: nvmet-auth: zero the AUTH_RECEIVE response buffer (CVE-2026-80791)
A flaw was found in the Linux kernel's nvmet-auth subsystem. During the pre-authentication handshake, a remote attacker can exploit an issue where the system allocates a response buffer but only partially initializes it. The uninitialized …
CVE-2026-80782Medium· 4.1kernel: HID: magicmouse: do not keep a stale msc->input if no input is claimed (CVE-2026-80782)
A flaw was found in the Magic Mouse Human Interface Device (HID) driver within the Linux kernel. When the `hidinput_connect()` function fails to register an input device, the driver may continue to use a pointer to memory that has already …
CVE-2026-80779Medium· 4.4kernel: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (CVE-2026-80779)
A flaw was found in the `net/ionic` component of the Linux kernel. This out-of-bounds write vulnerability occurs because the dedicated hardware timestamp RX queue's index can be used to access memory beyond the bounds of the normal transmi…
CVE-2026-80775High· 7.0PoCkernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
A flaw was found in the Linux kernel. A race condition exists in the `futex_hash_allocate()` function, specifically during the initial allocation of `mm->futex.phash.ref`. This vulnerability can be triggered in scenarios involving nested `…
CVE-2026-80777Medium· 4.7kernel: futex/pi: Plug private futex exec() race (CVE-2026-80777)
A flaw was found in the Linux kernel. A race condition exists in the futex/pi component during the `exec()` system call. This vulnerability occurs because the memory management (mm) check is incorrect when a task's memory is being swapped …
CVE-2026-80766Medium· 4.2kernel: HID: uclogic: fix use-after-free of inrange_timer on remove (CVE-2026-80766)
A flaw was found in the Linux kernel's Human Interface Device (HID) uclogic driver. During the removal of a uclogic device, a timing issue allows the `inrange_timer` to be re-armed after it has been cancelled. This can lead to the timer at…
CVE-2026-80767Medium· 4.7kernel: HID: sensor: custom: Fix use-after-free in enable_sensor (CVE-2026-80767)
A flaw was found in the Linux kernel's Human Interface Device (HID) sensor custom driver. A use-after-free vulnerability exists where the `enable_sensor` sysfs attribute can be accessed either before its associated memory is properly initi…
CVE-2026-80764Medium· 4.7kernel: Bluetooth: hci_event: fix LE list UAF on reset (CVE-2026-80764)
A flaw was found in the Linux kernel's Bluetooth subsystem. A local user could exploit a use-after-free vulnerability in the `hci_event` component. This occurs when the `hci_cc_reset()` function clears Bluetooth Low Energy (LE) lists witho…
CVE-2026-80762Medium· 4.7kernel: Bluetooth: hci_sync: Fix accept list UAF during suspend (CVE-2026-80762)
A flaw was found in the Bluetooth subsystem of the Linux kernel. During the system suspend process, a timing issue can occur where the `hci_update_event_filter_sync()` function attempts to access memory that has already been released. This…
CVE-2026-80758Medium· 4.7kernel: futex: Avoid private hash use-after-free on final put (CVE-2026-80758)
A flaw was found in the Linux kernel's futex subsystem. A race condition in the `futex_private_hash_put()` function allows a local attacker to trigger a use-after-free vulnerability. This occurs when a reference to a private hash is droppe…