Red Hat has 2,798 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1490 in the last 90 days against 571 in the 90 before. The busiest recent month was October 2026 with 627. The median CVSS is 6.5 (medium), with 135 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (187) and CWE-787 (157). Most affected products: Red Hat Enterprise Linux 9 (275), Red Hat Enterprise Linux 10 (167), Linux (74).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1490 prev 571
Weakness classes
Products
- Red Hat Enterprise Linux 9 275
- Red Hat Enterprise Linux 10 167
- Linux 74
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2798 CVEsRSS
CVE-2026-80760Low· 2.3kernel: Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255 (CVE-2026-80760)
A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. The `mgmt_hci_cmd_sync()` function incorrectly handles the `params_len` field, allowing a value greater than 255 to be processed. This mismatch between the decla…
CVE-2026-80790Medium· 4.1kernel: nvmet-fc: fix invalid free in LS IOD error path (CVE-2026-80790)
A flaw was found in the Linux kernel's nvmet-fc component. This vulnerability occurs during the initialization of the LS IOD array, where an error in memory deallocation can lead to an invalid memory free operation. A local attacker could …
CVE-2026-80806Medium· 4.7kernel: ext4: don't enable DAX on new encrypted files (CVE-2026-80806)
A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability allows data written to newly created encrypted files to bypass encryption when the filesystem is mounted with the 'dax=always' option. This occurs due to an incorre…
CVE-2026-80813Medium· 5.7kernel: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (CVE-2026-80813)
A flaw was found in the Linux kernel's nvmet subsystem. A remote attacker can trigger a NULL pointer dereference in the nvmet_execute_identify_nslist() function by issuing a specific Identify command (CNS 07h). This vulnerability can lead …
CVE-2026-80824High· 7.0kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
A flaw was found in the Linux kernel's USB subsystem (usbfs). An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usb_device structure is premat…
CVE-2026-80816Medium· 4.6kernel: ALSA: FCP: Use a private URB for the notification endpoint (CVE-2026-80816)
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) FireWire Control Protocol (FCP) driver. Incorrect handling of the Universal Serial Bus Request Block (URB) for the notification endpoint could lead to a system…
CVE-2026-80819Medium· 6.5kernel: Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (CVE-2026-80819)
A flaw was found in the Bluetooth RFCOMM (Radio Frequency Communication) subsystem of the Linux kernel. A remote attacker can send a specially crafted Bluetooth Disconnect (DISC) message to a device with a deferred RFCOMM channel. This can…
CVE-2026-80818Medium· 4.4kernel: iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown (CVE-2026-80818)
A flaw was found in the Linux kernel's iommu/tegra241-cmdqv driver. This vulnerability, a use-after-free, occurs when the system attempts to deinitialize a virtual interface during device teardown, accessing memory that has already been re…
CVE-2026-80829Medium· 4.6kernel: ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (CVE-2026-80829)
A flaw was found in the Linux kernel's ALSA USB audio driver. A local attacker with a specially crafted USB device could exploit this vulnerability. By providing a malformed `wMaxPacketSize` value, the device can trigger an out-of-bounds w…
CVE-2026-80830Medium· 5.1kernel: usb: core: Add lock to usb_wakeup_notification() (CVE-2026-80830)
A flaw was found in the Linux kernel's USB subsystem. A race condition in the `usb_wakeup_notification()` function could allow a local attacker or a malicious USB device to trigger a use-after-free vulnerability. This could lead to system …
CVE-2026-80832Medium· 4.4kernel: crypto: qce - fix CCM AAD buffer underallocation (CVE-2026-80832)
A flaw was found in the Linux kernel's QCE (Qualcomm Crypto Engine) cryptographic module. An issue with buffer underallocation in the `qce_aead_ccm_prepare_buf_assoclen()` function can lead to the allocated AAD (Additional Authenticated Da…
CVE-2026-80846Medium· 5.1kernel: xfrm: drop ESP-in-TCP packets with no ingress device (CVE-2026-80846)
A flaw was found in the Linux kernel's xfrm subsystem, which handles ESP-in-TCP packets. When queued ESP-in-TCP data is processed after its ingress network device has been removed, the system attempts to dereference a null pointer. This ca…
CVE-2026-80854Medium· 4.7kernel: usb: gadget: f_tcm: keep port count until LUN teardown completes (CVE-2026-80854)
A flaw was found in the Linux kernel's f_tcm USB gadget module. A race condition can occur during the teardown of a Logical Unit Number (LUN) when it overlaps with a session removal. This timing issue can lead to a use-after-free vulnerabi…
CVE-2026-80862Medium· 5.1kernel: nvme-tcp: fix usage of page_frag_cache (CVE-2026-80862)
A flaw was found in the Linux kernel's nvme-tcp component. When block devices are created in parallel threads, the `page_frag_cache` is used in a manner that is not thread-safe. This can lead to incorrect reference counting of memory pages…
CVE-2026-80878High· 7.0kernel: afs: Fix leak of ungot volume (CVE-2026-80878)
A flaw was found in the Linux kernel's AFS (Andrew File System) implementation. This issue occurs when `afs_lookup_volume_rcu()` fails to acquire a volume, leading to a resource leak. A local attacker could potentially exploit this flaw to…
CVE-2026-85769Medium· 6.5PoCA flaw was found in libtpms, a library that provides software TPM 2.0 emulation
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized sk…
CVE-2026-85534Medium· 5.9A flaw was found in libsoup
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_I…
CVE-2026-85197High· 7.6PoCA flaw was found in libsoup
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using …
CVE-2026-81665High· 7.5A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly
A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds.…
CVE-2026-85509Critical· 9.8⚖ disputedFreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
CVE-2026-85508Critical· 9.8⚖ disputedipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
CVE-2026-85504Critical· 9.8⚖ disputedFreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
CVE-2026-76925Medium· 5.8A flaw was found in Flatpak
A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTr…
CVE-2026-85781High· 8.7Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion…
Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion…
CVE-2026-85522Medium· 5.3⚖ disputedA vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0
A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of the file src/cluster_migrateslots.c of the component Slot Migration. The manipulation of the argume…
CVE-2026-81666Medium· 6.5An integer overflow was found in Corosync's handling of membership commit token messages
An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected mess…
CVE-2026-80731High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for …
In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for …
CVE-2026-80754High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value o…
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value o…
CVE-2026-80737High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it …
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it …
CVE-2026-85393High· 7.5node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification
node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures f…