Red Hat has 2,798 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1446 in the last 90 days against 609 in the 90 before. The busiest recent month was October 2026 with 627. The median CVSS is 6.5 (medium), with 135 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (187) and CWE-787 (157). Most affected products: Red Hat Enterprise Linux 9 (275), Red Hat Enterprise Linux 10 (167), Linux (74).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 0% vs 1% corpus
Median CVSS: 6.5
Publish → KEV: 2722 d median(6)
Last 90 days: 1446 prev 609

Weakness classes

Products

Red Hat Enterprise Linux 9 275
Red Hat Enterprise Linux 10 167
Linux 74
Red Hat Enterprise Linux BaseOS (v. 10) 55
Red Hat OpenShift AI (RHOAI) 50
build_of_keycloak 49

Follow Red Hat:RSS feed Save a search →Embed badge ↗

2798

Total CVEs

135

Critical

CISA KEV

Exploited

Worst active — by depth score

Red Hat vulnerabilities

CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.

2798 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Red Hat vulnerabilities

A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows

Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours)

A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled

A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy

axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency

axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js)

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments

axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json)

FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler (rail_server_handle_messages() in channels/rail/server/rail_main.c)

FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a heap out-of-bounds read in update_process_glyph_fragments()/glyph_cache_fragment_put() in libfreerdp/cache/glyph.c

FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in SCARD_IOCTL_READCACHEA and SCARD_IOCTL_WRITECACHEA operations

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base)

A flaw was found in the TokenManager component of the Keycloak identity management service

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant)

A flaw was found in the secure-client-uris client policy executor within Keycloak core services

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services

A flaw was found in the RoleContainerResource component of Keycloak

fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority (CVE-2026-18446)

A flaw was found in 389 Directory Server

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains