Red Hat has 2,660 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1488 in the last 90 days against 551 in the 90 before. The busiest recent month was October 2026 with 628. The median CVSS is 6.6 (medium), with 132 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (173) and CWE-787 (152). Most affected products: Red Hat Enterprise Linux 9 (281), Red Hat Enterprise Linux 10 (167), Linux (72).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.6
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1488 prev 551
Weakness classes
Products
- Red Hat Enterprise Linux 9 281
- Red Hat Enterprise Linux 10 167
- Linux 72
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2674 CVEsRSS
CVE-2026-112257High· 7.8Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bound…
CVE-2026-112259Medium· 5.5Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application.
CVE-2026-112260High· 7.1Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service.
CVE-2026-111757Medium· 5.3hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic (CVE-2026-111757)
A flaw was found in Hono's serveStatic middleware. This vulnerability allows a remote attacker to cause unauthorized information disclosure by bypassing path-based access controls. Because serveStatic decodes request paths a second time be…
CVE-2025-52290Medium· 5.5⚖ disputedffmpeg: ffmpeg: Denial of Service via crafted media file (CVE-2025-52290)
A flaw was found in ffmpeg. An attacker could exploit this vulnerability by providing a crafted media file to be processed by the application. This issue triggers a NULL pointer dereference in the avpriv_h264_has_num_reorder_frames functio…
CVE-2026-111755Medium· 5.9PoC⚖ disputedfollow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering (CVE-2026…
A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containi…
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)
A flaw was found in aiohttp. When processing multipart requests, the framework fails to properly limit the number of open file descriptors retained during request handling. An unauthenticated remote attacker can exploit this issue by sendi…
CVE-2026-112307High· 7.3sqlparse: sqlparse: Arbitrary code execution via unescaped PHP output formatting (CVE-2026-112307)
A flaw was found in sqlparse. The PHP output formatting filter does not properly sanitize dollar-sign sequences when formatting SQL statements into PHP code. An attacker can exploit this vulnerability by supplying crafted SQL input contain…
CVE-2026-103314High· 7.4Stackrox: stackrox: saml response replay allows multiple central authentication tokens
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, un…
CVE-2026-112214Medium· 6.5Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. Pro…
CVE-2026-8168Medium· 6.5qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements (CVE-2026-8168)
A flaw was found in the Qt SVG module. A remote attacker could trigger this issue by providing a specially crafted SVG (Scalable Vector Graphics) file containing deeply nested elements. When parsed, this leads to uncontrolled recursion and…
CVE-2026-80344High· 8.2PoCorg.apache.camel/camel-as2: Apache Camel AS2: Server-Side Request Forgery via unvalidated receipt destination (CVE-2026-80344)
A flaw was found in Apache Camel's AS2 (Applicability Statement 2) component. A remote attacker can trigger Server-Side Request Forgery (SSRF) by sending a message that specifies an arbitrary destination address for asynchronous delivery r…
CVE-2026-84180Medium· 5.3PoCorg.apache.camel/camel-knative: Apache Camel Knative: Information disclosure via error responses (CVE-2026-84180)
A flaw was found in Apache Camel's Knative component. When message processing fails on the consumer side, the application writes unhandled exception details—including class names, error messages, and stack traces—directly into the HTTP res…
CVE-2026-85250High· 7.5PoCorg.apache.camel/camel-xpath: camel-xpath: Information disclosure via XML external entity references (CVE-2026-85250)
A flaw was found in Apache Camel's XPath component. This vulnerability can lead to information disclosure and unauthorized network requests when the component evaluates XML expressions using unhardened streaming parser configurations. A re…
CVE-2026-112210Medium· 6.0Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic …
CVE-2026-79983High· 7.4PoCorg.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via path traversal (CVE-2026-79983)
A flaw was found in the Apache Camel FTP component. Remote-file consumers fail to validate directory listing entries received from remote servers, which allows path traversal outside the configured target directory. A compromised server or…
CVE-2026-78164High· 8.2PoCorg.apache.camel/camel-http-common: org.apache.camel/camel-http: org.apache.camel/camel-vertx-http: org.apache.camel/camel-undertow: org.ap…
A flaw was found in Apache Camel HTTP producer components. When processing messages that override destination addresses, the service improperly evaluates user-controlled header values through its internal configuration resolver. A remote a…
CVE-2026-16460High· 7.4Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive pol…
CVE-2026-112027Medium· 5.3PoCcms: light0011 cms: Information disclosure via filename manipulation in Uploadify (CVE-2026-112027)
A flaw was found in the Uploadify component of light0011 cms. A remote attacker can exploit an improper input handling vulnerability by manipulating the filename parameter in the check-exists script. This issue leads to information disclos…
CVE-2026-98702Medium· 6.5kernel: kernel: Denial of Service via invalid channel switch frame in mac80211 (CVE-2026-98702)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A nearby wireless attacker can cause a Denial of Service (DoS) by sending a crafted Channel Switch Announcement (CSA) frame with an unsupported bandwidth configuration. Be…
CVE-2026-98728Low· 2.5kernel: tpm: fix off-by-four bounds check in tpm2_get_random() (CVE-2026-98728)
A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a tr…
CVE-2026-98727Medium· 4.1kernel: nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known (CVE-2026-98727)
A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) multipath subsystem. The multipath driver inappropriately marks a storage device as supporting zoned storage before confirming its zone configuration. When a device …
CVE-2026-98730Medium· 6.7kernel: Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() (CVE-2026-98730)
A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. A local user with access to the Bluetooth Host Controller Interface (HCI) user channel can inject an oversized transmission packet. Because the driver fails to validate pa…
CVE-2026-98729Medium· 5.5kernel: x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h (CVE-2026-98729)
A flaw was found in the Linux kernel. On systems utilizing specific AMD processors, improper virtual address alignment for huge page memory mappings can allow a local user to cause a Denial of Service (DoS). When unmapping these misaligned…
CVE-2026-98731Medium· 6.5kernel: Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame() (CVE-2026-98731)
A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. An integer overflow vulnerability exists in the packet reception function when calculating the total length of incoming Bluetooth frames. An adjacent attacker within Bluet…
CVE-2026-98740Medium· 4.1kernel: EDAC/altera: Drop __init from ECC setup paths for re-probe safety (CVE-2026-98740)
A flaw was found in the Linux kernel's Altera Error Detection and Correction (EDAC) driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device r…
CVE-2026-98743Medium· 5.5kernel: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type (CVE-2026-98743)
A flaw was found in the Linux kernel's rt1017 SDCA audio codec driver. The driver fails to initialize stream configuration data before passing it to the sound subsystem, leaving configuration fields populated with uninitialized memory. A l…
CVE-2026-98747Medium· 4.4kernel: serial: core: fix NULL pointer dereference in serial_core_unregister_port() (CVE-2026-98747)
A flaw was found in the Linux kernel's serial core subsystem. This flaw allows a local user with administrative access to cause a Denial of Service (DoS) by crashing the system. The issue occurs during the unregistration of a serial port t…
CVE-2026-98746Low· 2.3kernel: serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() (CVE-2026-98746)
A flaw was found in the Linux kernel's ma35d1 serial driver. This flaw allows a local user to cause a Denial of Service (DoS) through resource exhaustion. The driver fails to release clock references during probe error handling or when the…
CVE-2026-98744Medium· 5.5kernel: ASoC: codecs: max98363: fix uninitialized stream_config->type (CVE-2026-98744)
A flaw was found in the Linux kernel's MAX98363 audio codec driver. A local user could trigger this vulnerability during audio stream configuration because internal stream parameters are left uninitialized in memory. This issue allows unin…