Red Hat has 2,302 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1622 in the last 90 days against 362 in the 90 before. The busiest recent month was October 2026 with 784. The median CVSS is 6.8 (medium), with 118 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-125 (148) and CWE-787 (135). Most affected products: Red Hat Enterprise Linux 9 (339), Red Hat Enterprise Linux 10 (188), Linux (82).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 1622 prev 362
Weakness classes
Products
- Red Hat Enterprise Linux 9 339
- Red Hat Enterprise Linux 10 188
- Linux 82
- Red Hat OpenShift AI (RHOAI) 64
- Chrome 61
- Red Hat Enterprise Linux BaseOS (v. 10) 60
Worst active — by depth score
CVE-2024-11394High· 8.8transformers: Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11394)74CVE-2024-11393High· 8.8transformers: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11…74CVE-2026-4631Critical· 9.8Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization69CVE-2026-92183High· 7.8gimp: gimp: Arbitrary code execution via stack-based buffer overflow in APNG parser (CVE-2026-92183)68CVE-2024-11392High· 7.5transformers: Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11392)68
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2302 CVEsRSS
CVE-2026-114038Medium· 5.1Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose…
CVE-2026-114041Medium· 6.5freerdp: FreeRDP: Windows RD Gateway consent message heap out-of-bounds read (CVE-2026-114041)
A flaw was found in FreeRDP. On Windows builds, client_cli_present_gateway_message passes a byte count as wide-character printf precision when printing RD Gateway consent or service messages. A malicious RD Gateway can send crafted pre-aut…
CVE-2026-114046Medium· 6.5freerdp: FreeRDP: null pointer dereference in smartcard emulation via crafted reader name (CVE-2026-114046)
A flaw was found in FreeRDP. The smartcard emulation backend accepts a null per-reader name in SCardGetStatusChange requests. A malicious RDP server can send a crafted reader-state entry with a null szReader, causing strcmp or _wcscmp to c…
CVE-2026-114044Medium· 5.3freerdp: FreeRDP: Android client heap out-of-bounds read via graphics pipeline (CVE-2026-114044)
A flaw was found in FreeRDP. The Android client does not validate mappedWidth and mappedHeight from RDPGFX_MAP_SURFACE_TO_WINDOW_PDU against the surface buffer. A malicious RDP server can cause android_UpdateWindowFromSurface to read beyon…
CVE-2026-114052High· 7.5vllm: vLLM: Denial of Service via unbounded processor caching in MOSS-Audio (CVE-2026-114052)
A flaw was found in vLLM. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) via memory exhaustion. When serving MOSS-Audio models, the unauthenticated tokenize endpoint caches processor configu…
CVE-2026-114051High· 7.5vllm: vllm: Denial of Service via improper token parameter validation (CVE-2026-114051)
A flaw was found in vllm. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted inference request containing an oversized minimum token parameter and an omitted maximum token parameter. Due to improper input …
CVE-2026-114102High· 7.5PoCadm-zip: adm-zip: Denial of Service via malformed ZIP archive decompression (CVE-2026-114102)
A flaw was found in adm-zip. A remote, unauthenticated attacker could cause a Denial of Service (DoS) by submitting a malformed or corrupted ZIP archive to an application using asynchronous decompression. Because the library fails to prope…
CVE-2026-114109High· 7.8uv: uv: Arbitrary code execution via path traversal in entry point names (CVE-2026-114109)
A flaw was found in uv. An attacker who convinces a user to install a malicious package can achieve arbitrary code execution. Because uv does not properly restrict entry point names, installing a crafted wheel package allows files to be wr…
CVE-2026-111943Medium· 6.8PoCcrypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signe…
CVE-2026-101609Medium· 4.4mysql: mysql: Denial of service in InnoDB (CVE-2026-101609)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101608Medium· 6.5mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101608)
A flaw was found in the MySQL Server Optimizer component. An authenticated remote attacker with low privileges can exploit this vulnerability over the network across multiple protocols. A successful attack allows the attacker to cause the …
CVE-2026-101607Medium· 4.9mysql: mysql: Denial of Service in Server Optimizer (CVE-2026-101607)
A flaw was found in the MySQL Server optimizer component. A remote attacker with high privileges and network access can exploit this vulnerability through multiple protocols to cause the service to hang or crash repeatedly. Successful expl…
CVE-2026-101612Medium· 4.0mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101612)
A flaw was found in the MySQL InnoDB component. A local, highly privileged attacker with access to the underlying infrastructure, requiring interaction from another user, can exploit this vulnerability to cause a hang or repeatable crash. …
CVE-2026-101611Medium· 4.4mysql: mysql: Denial of Service in InnoDB (CVE-2026-101611)
A flaw was found in the InnoDB component of MySQL. A remote attacker with high privileges and network access can exploit this vulnerability to cause the database server to hang or repeatedly crash. This issue results in a complete Denial o…
CVE-2026-101610Medium· 4.9mysql: mysql: Denial of Service via Server Optimizer component (CVE-2026-101610)
A flaw was found in MySQL's Server Optimizer component. A remote attacker with high administrative privileges can exploit this vulnerability across network protocols to trigger a complete Denial of Service (DoS). Successful exploitation ca…
CVE-2026-101615Medium· 4.4mysql: mysql: Denial of service in InnoDB (CVE-2026-101615)
A flaw was found in the InnoDB component of MySQL. A local attacker with high privileges on the host infrastructure can exploit this vulnerability to cause the database service to hang or repeatedly crash, resulting in a denial of service …
CVE-2026-101614Medium· 4.9mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101614)
A flaw was found in the InnoDB component of MySQL. An authenticated attacker with high privileges and network access can exploit this vulnerability to cause the server to hang or repeatedly crash. This issue results in a complete Denial of…
CVE-2026-101613Medium· 4.9mysql: mysql: Denial of service via DDL component (CVE-2026-101613)
A flaw was found in the Data Definition Language (DDL) component of MySQL Server and MySQL Cluster. An authenticated attacker with high privileges and network access can exploit this vulnerability to cause the server to hang or crash repea…
CVE-2026-101618Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101618)
A flaw was found in MySQL. A high-privileged remote attacker with network access can exploit this vulnerability in the InnoDB component to cause a Denial of Service (DoS). Successful exploitation allows the attacker to trigger a hang or re…
CVE-2026-101617Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101617)
A flaw was found in the InnoDB component of MySQL. An authenticated attacker with high privileges and network access can exploit this vulnerability to cause the database server to hang or repeatedly crash. This issue leads to a complete De…
CVE-2026-101616Medium· 6.5mysql: MySQL: Denial of Service via JSON component (CVE-2026-101616)
A flaw was found in the JSON component of MySQL Server and MySQL Cluster. A remote attacker with low-level privileges and network access can exploit this vulnerability to cause the server to hang or crash repeatedly. Successful exploitatio…
CVE-2026-101622Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101622)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101621Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101621)
A flaw was found in the InnoDB component of MySQL. A high-privileged remote attacker with network access could exploit this vulnerability to cause a Denial of Service (DoS). Successful attacks can result in an unauthorized hang or repeatab…
CVE-2026-101619Medium· 4.9mysql: mysql: Denial of Service in InnoDB (CVE-2026-101619)
A flaw was found in the InnoDB component of MySQL. A high-privileged attacker with network access could exploit this vulnerability to trigger an unexpected hang or crash of the database server. A successful attack can result in a complete …
CVE-2026-101624Medium· 4.9mysql: mysql: Denial of service via InnoDB storage engine (CVE-2026-101624)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101623Medium· 4.9mysql: mysql: Denial of Service via server optimizer flaw (CVE-2026-101623)
A flaw was found in the Optimizer component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory f…
CVE-2026-101627Medium· 4.4mysql: mysql: Denial of Service in InnoDB component (CVE-2026-101627)
A flaw was found in the InnoDB component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advisory for …
CVE-2026-101637Medium· 5.5mysql: mysql: Denial of Service via InnoDB component (CVE-2026-101637)
A flaw was found in MySQL's InnoDB component. A high-privileged remote attacker with network access can exploit this vulnerability to cause the server to hang or crash repeatedly, resulting in a Denial of Service (DoS). Additionally, explo…
CVE-2026-101679High· 7.5mysql: mysql: Denial of Service via multiple protocols (CVE-2026-101679)
A flaw was found in the Client programs component of MySQL. This issue may allow an attacker to impact the confidentiality, integrity, and/or availability of MySQL Server depending on the vulnerability details. Refer to the Oracle CPU advi…
CVE-2026-101721Medium· 4.9mysql: mysql: Denial of Service in Server Components Services (CVE-2026-101721)
A flaw was found in mysql. A remote attacker with high privileges and network access can exploit this vulnerability to cause a Denial of Service (DoS). By targeting the server component services, the attacker can cause the database to hang…