Red Hat has 2,798 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1446 in the last 90 days against 609 in the 90 before. The busiest recent month was October 2026 with 627. The median CVSS is 6.5 (medium), with 135 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (187) and CWE-787 (157). Most affected products: Red Hat Enterprise Linux 9 (275), Red Hat Enterprise Linux 10 (167), Linux (74).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1446 prev 609
Weakness classes
Products
- Red Hat Enterprise Linux 9 275
- Red Hat Enterprise Linux 10 167
- Linux 74
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2798 CVEsRSS
CVE-2025-8277Low· 3.1A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses
A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This i…
CVE-2025-39703Medium· 6.5⚖ disputedkernel: net, hsr: reject HSR frame if skb can't hold tag (CVE-2025-39703)
A flaw was found in the Linux kernel's High-availability Seamless Redundancy (HSR) networking subsystem. This flaw allows an adjacent network attacker or a local user to cause a denial of service (DoS) by transmitting malformed HSR network…
CVE-2025-38733Medium· 5.5⚖ disputedkernel: Linux kernel: Denial of Service due to incorrect lowcore memory mapping (CVE-2025-38733)
A flaw was found in the Linux kernel. Due to an incorrect identity mapping of the lowcore, a critical memory region, NULL pointer accesses may succeed instead of causing an exception. This vulnerability allows a local attacker to cause a D…
CVE-2025-39689Medium· 6.4kernel: ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689)
A flaw was found in the Linux kernel. A Use-After-Free (UAF) vulnerability exists in the ftrace subsystem during the reading of tracing filter files. The filter reader retains a direct pointer to global filter data rather than creating an …
CVE-2025-9566High· 8.1There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In…
CVE-2025-55190High· 8.8PoCgithub.com/argoproj/argo-cd: Project API Token Exposes Repository Credentials (CVE-2025-55190)
An information leak was discovered in how Argo CD handles API tokens. The project details API endpoint could provide unintentional access to sensitive repository credentials.
CVE-2025-6984High· 7.5langchain-community: Langchain-community insecure XML parsing (CVE-2025-6984)
An XML External Entity flaw has been discovered in the langchain-community python package. The EverNoteLoader component has an insecure use of the `etree.iterparse()` function which does not disable external entity references. This can lea…
CVE-2025-9901Medium· 5.9A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authen…
CVE-2025-9784High· 7.5PoCA flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive serv…
CVE-2025-58058Medium· 5.3xz is a pure golang package for reading and writing xz-compressed files
xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead …
CVE-2025-48956High· 7.5vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests (CVE-2025-48956)
A flaw was found in vLLM. A denial of service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large X-Forwarded-For header to an HTTP endpoint. This results in server memory exhaustion, potential…
CVE-2025-57809High· 7.5xgrammar: XGrammar affected by Denial of Service by infinite recursion grammars (CVE-2025-57809)
A flaw was found in xgrammar. Recursive grammar definitions could trigger infinite recursion during parsing in GrammarMatcherBase::ExpandEquivalentStackElements, leading to unbounded stack growth and a segmentation fault. This vulnerabilit…
CVE-2025-4877Medium· 4.5There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function
There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow…
CVE-2025-5187Medium· 6.7kubernetes: kube-apiserver: Nodes can delete themselves by adding an OwnerReference (CVE-2025-5187)
A vulnerability was found in the kube-apiserver's NodeRestriction admission controller, where node users can delete their corresponding node object by setting their own OwnerReference to a cluster-scoped resource. This flaw allows an attac…
CVE-2025-8556Low· 3.7Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results
A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point validation during Diffie-Hellman key exchange.
CVE-2025-8419Medium· 5.3A vulnerability was found in Keycloak-services
A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the …
CVE-2025-5988Medium· 5.3Aap-gateway: csrf origin checking is disabled
A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.
CVE-2023-32256High· 7.50dayA flaw was found in the Linux kernel's ksmbd component
A flaw was found in the Linux kernel's ksmbd component. A race condition between smb2 close operation and logoff in multichannel connections could result in a use-after-free issue.
CVE-2025-54576High· 7.4github.com/oauth2-proxy/oauth2-proxy: OAuth2-Proxy authentication bypass (CVE-2025-54576)
An authentication bypass flaw was found in the OAuth2-Proxy project. This bypass affects systems that have configured their deployment to skip authentication on endpoints that match a deployment-defined regular expression. HTTP parameters …
CVE-2023-2593Medium· 5.9A flaw exists within the Linux kernel's handling of new TCP connections
A flaw exists within the Linux kernel's handling of new TCP connections. The issue results from the lack of memory release after its effective lifetime. This vulnerability allows an unauthenticated attacker to create a denial of service …
CVE-2025-8194High· 7.5There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs
There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and dea…
CVE-2025-8283Low· 3.7A vulnerability was found in the netavark package, a network stack for containers used with Podman
A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When …
CVE-2025-4878Low· 3.6A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function
A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to p…
CVE-2025-53643Low· 3.7aiohttp: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643)
A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smug…
CVE-2025-7519Medium· 6.7A flaw was found in polkit
A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not…
CVE-2025-7365High· 7.1A flaw was found in Keycloak
A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. Th…
CVE-2025-6395Medium· 6.5A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().
A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().
CVE-2025-53547High· 8.5PoChelm.sh/helm/v3: Helm Chart Code Execution (CVE-2025-53547)
A command injection vulnerability has been identified in Helm, a package manager for Kubernetes. An attacker can craft a malicious Chart.yaml file with specially linked dependencies in a Chart.lock file. If the Chart.lock file is a symboli…
CVE-2025-7345High· 7.5PoCA flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c)
A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur duri…
CVE-2025-6017Medium· 5.5Rhacm: users with clusterreader role can see credentials from managed-clusters
A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials t…