Red Hat has 2,798 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1446 in the last 90 days against 609 in the 90 before. The busiest recent month was October 2026 with 627. The median CVSS is 6.5 (medium), with 135 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (187) and CWE-787 (157). Most affected products: Red Hat Enterprise Linux 9 (275), Red Hat Enterprise Linux 10 (167), Linux (74).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1446 prev 609
Weakness classes
Products
- Red Hat Enterprise Linux 9 275
- Red Hat Enterprise Linux 10 167
- Linux 74
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2798 CVEsRSS
CVE-2023-3971High· 7.3PoCController: html injection in custom login info
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
CVE-2023-4732Medium· 4.7Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h
A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.
CVE-2023-42756Medium· 4.4PoCKernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap
A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local …
CVE-2023-5157High· 7.5Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6
A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.
CVE-2023-4527Medium· 6.5Glibc: stack read overflow in getaddrinfo in no-aaaa mode
A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially discl…
CVE-2023-4959Medium· 6.5Quay: cross-site request forgery (csrf) on config-editor page
A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page…
CVE-2023-3255Medium· 6.5Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could …
CVE-2023-4042Medium· 5.5Ghostscript: incomplete fix for cve-2020-16305
A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.
CVE-2023-3899High· 7.8Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the sta…
CVE-2023-4387High· 7.1Kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf()
A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free…
CVE-2023-4385Medium· 5.5Kernel: jfs: null pointer dereference in dbfree()
A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check.
CVE-2023-39418Low· 3.1Postgresql: merge fails to enforce update or select row security policies
A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do n…
CVE-2023-4147High· 7.8PoCKernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
CVE-2023-4194Medium· 5.5Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid
A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomp…
CVE-2023-4133Medium· 5.5Kernel: cxgb4: use-after-free in ch_flower_stats_cb()
A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user t…
CVE-2023-4132Medium· 5.5Kernel: smsusb: use-after-free caused by do_submit_urb()
A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial…
CVE-2023-38560Medium· 5.5Ghostscript: integer overflow in pcl/pl/plfont.c:418 in pl_glyph_name
An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.
CVE-2023-3773Medium· 5.5A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem)
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing n…
CVE-2023-3772Medium· 5.5A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem)
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading…
CVE-2023-3812High· 7.8Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags
An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or…
CVE-2023-3745Medium· 5.5Imagemagick: heap-buffer-overflow in pushcharpixel() in quantum-private.h
A heap-based buffer overflow issue was found in ImageMagick's PushCharPixel() function in quantum-private.h. This issue may allow a local attacker to trick the user into opening a specially crafted file, triggering an out-of-bounds read …
CVE-2023-3750Medium· 6.5Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service
A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue …
CVE-2023-3567High· 7.1Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
CVE-2023-3019Medium· 6.0Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
CVE-2023-33951Medium· 6.70dayKernel: vmwgfx: race condition leading to information disclosure vulnerability
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a lo…
CVE-2023-33952Medium· 6.70dayKernel: vmwgfx: double free within the handling of vmw_buffer_object objects
A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations …
CVE-2023-3384Medium· 5.4A flaw was found in the Quay registry
A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is not performed when the label comes from an imag…
CVE-2023-34966High· 7.5Samba: infinite loop in mdssvc rpc service for spotlight
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network …
CVE-2023-3347Medium· 5.9Samba: smb2 packet signing is not enforced when "server signing = required" is set
A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is man…
CVE-2023-34967Medium· 5.3Samba: type confusion in mdssvc rpc service for spotlight
A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the val…