Red Hat Linux OS and other open source products

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Red Hat product.

RSS Feeds for Red Hat security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Red Hat Sorted by Most Security Vulnerabilities since 2018

Red Hat Enterprise Linux (RHEL)2693 vulnerabilities

Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.

Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.

Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop

Red Hat Enterprise Linux Eus1137 vulnerabilities

Red Hat Enterprise Linux Server Aus884 vulnerabilities

Red Hat Enterprise Linux Server Tus701 vulnerabilities

Red Hat Openshift608 vulnerabilities

Red Hat Rhel Eus590 vulnerabilities

Red Hat Rhel E4s494 vulnerabilities

Red Hat Rhel Tus436 vulnerabilities

Red Hat Rhel Aus427 vulnerabilities

Red Hat Enterprise Linux Server Eus414 vulnerabilities

Red Hat Satellite362 vulnerabilities

Red Hat Rhel Eus Long Life344 vulnerabilities

Red Hat Rhel Els332 vulnerabilities

Red Hat Openshift Ai325 vulnerabilities

Red Hat Jboss Enterprise Application Platform298 vulnerabilities

Red Hat Hummingbird281 vulnerabilities

Red Hat Openstack277 vulnerabilities

Red Hat Jbosseapxp237 vulnerabilities

Red Hat Openshift Container Platform230 vulnerabilities

Red Hat Build Keycloak220 vulnerabilities

Red Hat Jboss Fuse208 vulnerabilities

Red Hat Ansible Automation Platform204 vulnerabilities

Red Hat Rhivos199 vulnerabilities

Red Hat Jboss Data Grid198 vulnerabilities

Red Hat Single Sign On177 vulnerabilities

Red Hat Acm155 vulnerabilities

Red Hat Quay154 vulnerabilities

Red Hat Enterprise Linux Ai154 vulnerabilities

Red Hat Openshift Devspaces153 vulnerabilities

Red Hat Rhdh124 vulnerabilities

Red Hat Software Collections123 vulnerabilities

Red Hat Keycloak123 vulnerabilities

Red Hat Cryostat120 vulnerabilities

Red Hat Virtualization115 vulnerabilities

Red Hat Discovery114 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems108 vulnerabilities

Red Hat Ai Inference Server105 vulnerabilities

Red Hat Kafka104 vulnerabilities

Red Hat Enterprise Linux Power Little Endian103 vulnerabilities

Red Hat Jboss Enterprise Bpms Platform100 vulnerabilities

Red Hat Multicluster Engine96 vulnerabilities

Red Hat Trusted Artifact Signer96 vulnerabilities

Red Hat Single Sign On95 vulnerabilities

Red Hat Openshift Pipelines95 vulnerabilities

Red Hat Ceph Storage94 vulnerabilities

Red Hat Apache Camel Hawtio92 vulnerabilities

Red Hat Advanced Cluster Security91 vulnerabilities

Red Hat Logging91 vulnerabilities

Red Hat Container Native Virtualization90 vulnerabilities

Red Hat Enterprise Linux Power Little Endian Eus88 vulnerabilities

Red Hat Service Mesh84 vulnerabilities

Red Hat Amq Streams84 vulnerabilities

Red Hat Camel Spring Boot84 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems Eus82 vulnerabilities

Red Hat Openshift Data Foundation82 vulnerabilities

Red Hat Rhui79 vulnerabilities

Red Hat Amq Broker77 vulnerabilities

Red Hat Ansible Portal77 vulnerabilities

Red Hat Openshift Lightspeed75 vulnerabilities

Red Hat Serverless75 vulnerabilities

Red Hat Ansible Automation Platform Developer72 vulnerabilities

Red Hat Http Server72 vulnerabilities

Red Hat Enterprise Linux Scientific Computing71 vulnerabilities

Red Hat Migration Toolkit Applications70 vulnerabilities

Red Hat Ansible Tower69 vulnerabilities

Red Hat Openshift Gitops68 vulnerabilities

Red Hat Quarkus64 vulnerabilities

Red Hat Ansible Automation Platform Inside63 vulnerabilities

Red Hat 3scale Amp62 vulnerabilities

Red Hat Enterprise Linux Server Power Little Endian Update Services Sap Solutions61 vulnerabilities

Red Hat Apache Camel Spring Boot58 vulnerabilities

Red Hat Podman Desktop58 vulnerabilities

Red Hat Apicurio Registry56 vulnerabilities

Red Hat Rhmt56 vulnerabilities

Red Hat Camel Quarkus55 vulnerabilities

Red Hat Libvirt55 vulnerabilities

Red Hat Multicluster Globalhub54 vulnerabilities

Red Hat Service Registry54 vulnerabilities

Red Hat Satellite Capsule53 vulnerabilities

Red Hat Virtualization Host53 vulnerabilities

Red Hat Openshift Distributed Tracing52 vulnerabilities

Red Hat Network Observ Optr51 vulnerabilities

Red Hat Directory Server47 vulnerabilities

Red Hat Enterprise Linux Power Big Endian45 vulnerabilities

Red Hat Jboss Core Services45 vulnerabilities

Red Hat Insights Proxy44 vulnerabilities

Red Hat Enterprise Linux Server Update Services Sap Solutions43 vulnerabilities

Red Hat Enterprise Linux For Real Time43 vulnerabilities

Red Hat Ansible42 vulnerabilities

Red Hat Enterprise Linux For Arm 6442 vulnerabilities

Red Hat Confidential Compute Attestation42 vulnerabilities

Red Hat Enterprise Linux Aus41 vulnerabilities

Recent Red Hat Security Advisories

Advisory	Title	Published
RHSA-2026:57844	(RHSA-2026:57844) Moderate: mod_md security update	August 20, 2026
RHSA-2026:57785	(RHSA-2026:57785) Important: dracut security update	August 20, 2026
RHSA-2026:57775	(RHSA-2026:57775) Important: dracut security update	August 20, 2026
RHSA-2026:57741	(RHSA-2026:57741) Important: libreswan security update	August 20, 2026
RHSA-2026:57649	(RHSA-2026:57649) Important: golang security update	August 20, 2026
RHSA-2026:57642	(RHSA-2026:57642) Moderate: mod_md security update	August 20, 2026
RHSA-2026:57641	(RHSA-2026:57641) Moderate: mod_md security update	August 20, 2026
RHSA-2026:57638	(RHSA-2026:57638) Important: python-urwid security update	August 20, 2026
RHSA-2026:57637	(RHSA-2026:57637) Important: python-urwid security update	August 20, 2026
RHSA-2026:57633	(RHSA-2026:57633) Important: postgresql security update	August 20, 2026

By the Year

In 2026 there have been 2853 vulnerabilities in Red Hat with an average score of 7.2 out of ten. Last year, in 2025 Red Hat had 1171 security vulnerabilities published. That is, 1682 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.33.

Year	Vulnerabilities	Average Score
2026	2853	7.18
2025	1171	6.85
2024	1692	6.82
2023	1206	6.74
2022	1362	6.96
2021	1123	6.61
2020	664	6.39
2019	772	6.98
2018	760	7.16

It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-73267	Aug 21, 2026	MCE clusterclaims-controller DoS via unauthorized ManagedCluster deletion A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.	Multicluster Engine
CVE-2026-73137	Aug 20, 2026	RHACM multicloud-operators-subscription: privilege escalation allows exfil A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure.	Acm
CVE-2026-67567	Aug 20, 2026	Arbitrary k8s resource deployment via HelmRelease multicloud-operator-subscription A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise.	Acm
CVE-2026-66788	Aug 20, 2026	Lighthouse Namespace Injection for Unauthorized EndpointSlice/ServiceImport A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster.	Acm
CVE-2026-66787	Aug 20, 2026	RedHat AMK Lighthouse IP validation flaw enabling MITM A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation.	Acm
CVE-2026-66785	Aug 20, 2026	Red Hat Submariner Unauthorized Network Traffic Redirection Vulnerability A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for these arbitrary ranges from peer clusters will be rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption.	Acm
CVE-2026-77176	Aug 20, 2026	Kata Containers: Host Operator Elevates Priv via CreateContainer Mount Validation A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input.	Openshift
CVE-2026-19611	Aug 20, 2026	WildFly Elytron Unicode Normalization Weakens Password Hashing A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.	Camel Quarkus Debezium Build Keycloak And others...
CVE-2026-73199	Aug 20, 2026	Null Pointer Deref in FreeIPA ipa-enrollment SLAPI (DoS) A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, an attacker can trigger a server crash, potentially causing a denial of service.	Enterprise Linux (RHEL)
CVE-2026-11861	Aug 20, 2026	Privilege Escalation: PAC Omission in FreeIPA AD Trust A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.	Enterprise Linux (RHEL)
CVE-2026-73198	Aug 20, 2026	FreeIPA Memory Exhaustion DoS via Large /ipa/i18n_messages Request A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.	Enterprise Linux (RHEL)
CVE-2026-13097	Aug 20, 2026	FreeIPA Kerberos Principal Uniqueness Flaw Priv Escalation A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.	Enterprise Linux (RHEL)
CVE-2026-73196	Aug 20, 2026	FreeIPA CPU DoS via Oversized OTP Key A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service.	Enterprise Linux (RHEL)
CVE-2026-73197	Aug 20, 2026	FreeIPA DoS via Oversized POST: /ipa/migration/migration.py A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.	Enterprise Linux (RHEL)
CVE-2026-18917	Aug 20, 2026	libvirt NodeGetFreePages Int Overflow (Privilege Escalation) A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.	Enterprise Linux (RHEL) Enterprise Linux Nvidia
CVE-2026-77014	Aug 20, 2026	libsoup HTTP Range Header Partial Content Bug (CVE-2026-77014) A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.	Enterprise Linux (RHEL) Openshift
CVE-2026-19582	Aug 20, 2026	Binutils <2.46.1: PE File Stack Bof Arbitrary Code Exec In binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could execute arbitrary code unknowningly via a stack buffer overflow out of bounds write.	Rhmt Enterprise Linux (RHEL) Hummingbird And others...
CVE-2026-76827	Aug 19, 2026	Auth Cluster Index Tampering via Delta-Sync in Search-Indexer A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to data owned by the calling cluster. An attacker could exploit this by crafting specific user identifiers (UIDs) with a different cluster's prefix.	Acm
CVE-2026-76139	Aug 19, 2026	Unverified Remote Script in RH acm-operator-bundle Grants Build Access A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.	Acm
CVE-2026-75569	Aug 19, 2026	mce-operator-bundle Build Process Code Injection via Unverified Remote Scripts A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.	Multicluster Engine
CVE-2026-70496	Aug 19, 2026	Privilege Escalation via overpriv ClusterRole in search-v2-operator (Red Hat) A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CSRs), and manage ManifestWork. This grants excessive privileges beyond what is necessary for the operator's intended function, potentially leading to privilege escalation within the cluster.	Acm
CVE-2026-18874	Aug 19, 2026	RedHat volsync-addon-controller: YAML Injection via OLM Subscription Annotation A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.	Acm
CVE-2026-66794	Aug 19, 2026	Red Hat Multicluster Engine cluster-proxy-addon/CVE-2026-66794: Auth Bypass A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.	Multicluster Engine
CVE-2026-71470	Aug 19, 2026	Privilege Escalation via Unvalidated Env Setup in Red Hat Search Operator A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions.	Acm
CVE-2026-43961	Aug 19, 2026	Vim netrw Arbitrary Vimscript via Quote Breakout in Mark/Unmark A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.	Enterprise Linux (RHEL) Openshift
CVE-2026-76235	Aug 19, 2026	Cockpit-ws Memory Leak Allows Remote DoS via Unauth Request A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.	Enterprise Linux (RHEL) Openshift Devspaces
CVE-2026-76166	Aug 19, 2026	mod_cluster AdvertiseListener NullPointerException via UDP Multicast A flaw was found in mod_cluster's AdvertiseListenerImpl (org.jboss.modcluster core module). A single crafted UDP multicast datagram with a valid HTTP status line and a "Server:" header but without the "Date:", "Digest:", and "Sequence:" headers triggers a NullPointerException in verifyDigest() that is not caught by the worker thread's exception handler. This causes the advertise listener thread to terminate permanently. The failure is silent (isListening() continues to return true) and persists until the node is restarted. The crash occurs before the AdvertiseSecurityKey comparison, so deployments with a configured security key are still affected.	Jboss Enterprise Application Platform Jbosseapxp Jboss Enterprise Web Server And others...
CVE-2026-75900	Aug 19, 2026	swtpm OOB read in SWTPM_NVRAM_CheckHeader: heap overread & log leak An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.	Enterprise Linux (RHEL)
CVE-2026-70907	Aug 18, 2026	Oracle JSSE TLS DoS (CVE-2026-70907) Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-70906	Aug 18, 2026	Oracle Java SE 2D DoS (before 25.0.4/26.0.2) Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-61308	Aug 18, 2026	Oracle Java SE Networking API CVE-2026-61308 (8u50126.0.2) Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVE-2026-60589	Aug 18, 2026	Vulnerability in the Oracle Java SE Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-15571	Aug 18, 2026	A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.	Build Keycloak Jboss Data Grid Jbosseapxp And others...
CVE-2026-66780	Aug 18, 2026	A flaw was found in the submariner-operator component A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (MITM) attack across the entire cluster mesh.	Acm
CVE-2026-66783	Aug 18, 2026	Red Hat ACMM Submariner-Operator Escalation via Unvalidated Image Path A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalidated image path. This lack of validation enables an attacker to execute arbitrary code with elevated privileges across the entire cluster, including control-plane nodes, by deploying a malicious image.	Acm
CVE-2026-66782	Aug 18, 2026	Submariner Operator: Broker SA Token Exposure Grants Full Mesh Control A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.	Acm
CVE-2026-66781	Aug 18, 2026	Submariner Operator Exposes Unencrypted IPsec PSK A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.	Acm
CVE-2026-18963	Aug 18, 2026	Unauthenticated Reset Credentials in KeycloakServices (Red Hat Build) A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.	Build Keycloak Jbosseapxp Red Hat Single Sign On And others...
CVE-2026-75924	Aug 18, 2026	A flaw was found in managed-serviceaccount A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.	Acm Multicluster Engine
CVE-2026-71365	Aug 18, 2026	A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.	Ansible Automation Platform
CVE-2026-12564	Aug 18, 2026	A flaw was found in the AAP Controller's HashiCorp Vault credential plugin A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY.	Ansible Automation Platform
CVE-2026-75485	Aug 18, 2026	A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.	Acm
CVE-2026-73834	Aug 18, 2026	A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.	Acm
CVE-2026-66793	Aug 18, 2026	A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.	Acm
CVE-2026-75032	Aug 18, 2026	BlueZ AVRCP Packet Length Validation Bypass -> DoS A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.	Enterprise Linux (RHEL)
CVE-2026-19608	Aug 18, 2026	Keycloak Group Policy Eval Bug: Group Name Ambiguity Allows Unauthorized Access A flaw was found in the group policy provider of Keycloak authorization services, which is used to manage fine-grained access control to resources. The issue occurs when the system evaluates group-based policies using tokens that only contain group names rather than full paths. If two groups in different parts of the organization share the same name, a user in the unauthorized group can be mistaken for a member of the authorized group. This can allow a user to gain unauthorized access to protected resources they should not be able to reach.	Build Keycloak Red Hat Single Sign On
CVE-2026-66795	Aug 17, 2026	Privilege Escalation in Red Hat managedcluster-import-controller via Improper CSR Validation A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.	Multicluster Engine
CVE-2026-71472	Aug 17, 2026	acm-search-v2-rhel9 RHEL9 RCE via WORK_MEM injection A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string provided in the Search CR is not properly validated before being used in a bash script and an SQL query. Successful exploitation could lead to arbitrary code execution within the privileged postgres pod, potentially compromising the system.	Acm
CVE-2026-70495	Aug 17, 2026	CVE-2026-70495: Overly Broad Permissions in Red Hat Search V2 Operator ServiceAccount A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service account, they could exploit this to achieve `system:masters` access, granting them full control over the cluster.	Acm
CVE-2026-66792	Aug 17, 2026	Red Hat Multi-Cloud Operators Subscription PrivEsc via Crafted Annotations A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.	Multicluster Globalhub Acm Openshift And others...