Red Hat Linux OS and other open source products

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Red Hat product.

RSS Feeds for Red Hat security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Red Hat Sorted by Most Security Vulnerabilities since 2018

Red Hat Enterprise Linux (RHEL)2889 vulnerabilities

Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.

Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.

Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop

Red Hat Enterprise Linux Eus1211 vulnerabilities

Red Hat Enterprise Linux Server Aus884 vulnerabilities

Red Hat Enterprise Linux Server Tus701 vulnerabilities

Red Hat Openshift689 vulnerabilities

Red Hat Rhel Eus682 vulnerabilities

Red Hat Rhel E4s582 vulnerabilities

Red Hat Rhel Tus496 vulnerabilities

Red Hat Rhel Aus479 vulnerabilities

Red Hat Enterprise Linux Server Eus414 vulnerabilities

Red Hat Rhel Eus Long Life396 vulnerabilities

Red Hat Satellite389 vulnerabilities

Red Hat Openshift Ai367 vulnerabilities

Red Hat Rhel Els363 vulnerabilities

Red Hat Hummingbird350 vulnerabilities

Red Hat Jboss Enterprise Application Platform331 vulnerabilities

Red Hat Openstack306 vulnerabilities

Red Hat Build Keycloak267 vulnerabilities

Red Hat Jbosseapxp255 vulnerabilities

Red Hat Ansible Automation Platform248 vulnerabilities

Red Hat Jboss Fuse243 vulnerabilities

Red Hat Single Sign On238 vulnerabilities

Red Hat Openshift Container Platform230 vulnerabilities

Red Hat Jboss Data Grid217 vulnerabilities

Red Hat Rhivos199 vulnerabilities

Red Hat Openshift Devspaces161 vulnerabilities

Red Hat Acm161 vulnerabilities

Red Hat Quay159 vulnerabilities

Red Hat Enterprise Linux Ai157 vulnerabilities

Red Hat Kafka142 vulnerabilities

Red Hat Rhdh128 vulnerabilities

Red Hat Discovery126 vulnerabilities

Red Hat Software Collections123 vulnerabilities

Red Hat Keycloak123 vulnerabilities

Red Hat Cryostat121 vulnerabilities

Red Hat Ai Inference Server116 vulnerabilities

Red Hat Virtualization115 vulnerabilities

Red Hat Camel Spring Boot111 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems108 vulnerabilities

Red Hat Ansible Automation Platform Developer104 vulnerabilities

Red Hat Enterprise Linux Power Little Endian103 vulnerabilities

Red Hat Rhui103 vulnerabilities

Red Hat Jboss Enterprise Bpms Platform102 vulnerabilities

Red Hat Ceph Storage100 vulnerabilities

Red Hat Apache Camel Hawtio99 vulnerabilities

Red Hat Multicluster Engine99 vulnerabilities

Red Hat Trusted Artifact Signer96 vulnerabilities

Red Hat Openshift Pipelines95 vulnerabilities

Red Hat Single Sign On95 vulnerabilities

Red Hat Amq Broker94 vulnerabilities

Red Hat Ansible Automation Platform Inside94 vulnerabilities

Red Hat Container Native Virtualization93 vulnerabilities

Red Hat Logging92 vulnerabilities

Red Hat Advanced Cluster Security91 vulnerabilities

Red Hat Quarkus91 vulnerabilities

Red Hat Enterprise Linux Power Little Endian Eus88 vulnerabilities

Red Hat Service Mesh86 vulnerabilities

Red Hat Amq Streams86 vulnerabilities

Red Hat Openshift Data Foundation84 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems Eus82 vulnerabilities

Red Hat Camel Quarkus79 vulnerabilities

Red Hat Ansible Portal78 vulnerabilities

Red Hat Apicurio Registry77 vulnerabilities

Red Hat Serverless76 vulnerabilities

Red Hat Openshift Lightspeed75 vulnerabilities

Red Hat Http Server74 vulnerabilities

Red Hat Migration Toolkit Applications72 vulnerabilities

Red Hat Cert Manager72 vulnerabilities

Red Hat Enterprise Linux Scientific Computing71 vulnerabilities

Red Hat Ansible Tower69 vulnerabilities

Red Hat Satellite Capsule68 vulnerabilities

Red Hat Openshift Gitops68 vulnerabilities

Red Hat 3scale Amp64 vulnerabilities

Red Hat Enterprise Linux Server Power Little Endian Update Services Sap Solutions61 vulnerabilities

Red Hat Podman Desktop58 vulnerabilities

Red Hat Apache Camel Spring Boot58 vulnerabilities

Red Hat Rhmt57 vulnerabilities

Red Hat Debezium55 vulnerabilities

Red Hat Multicluster Globalhub55 vulnerabilities

Red Hat Libvirt55 vulnerabilities

Red Hat Directory Server55 vulnerabilities

Red Hat Service Registry54 vulnerabilities

Red Hat Satellite Utils54 vulnerabilities

Red Hat Virtualization Host53 vulnerabilities

Red Hat Openshift Distributed Tracing52 vulnerabilities

Red Hat Network Observ Optr51 vulnerabilities

Red Hat Jboss Core Services48 vulnerabilities

Red Hat Enterprise Linux Power Big Endian45 vulnerabilities

Red Hat Confidential Compute Attestation45 vulnerabilities

Red Hat Insights Proxy44 vulnerabilities

Red Hat Enterprise Linux Server Update Services Sap Solutions43 vulnerabilities

Red Hat Enterprise Linux For Real Time43 vulnerabilities

Recent Red Hat Security Advisories

Advisory	Title	Published
RHSA-2026:92059	(RHSA-2026:92059) Important: Red Hat JBoss Enterprise Application Platform 8.1.9 security update	October 28, 2026
RHSA-2026:92057	(RHSA-2026:92057) Important: Red Hat JBoss Enterprise Application Platform 8.1.9 security update	October 28, 2026
RHSA-2026:92051	(RHSA-2026:92051) Important: mrtg security update	October 28, 2026
RHSA-2026:92012	(RHSA-2026:92012) Important: firefox security update	October 28, 2026
RHSA-2026:92011	(RHSA-2026:92011) Important: firefox security update	October 28, 2026
RHSA-2026:92006	(RHSA-2026:92006) Red Hat OpenShift Dev Spaces 3.31.1 Release.	October 28, 2026
RHSA-2026:91997	(RHSA-2026:91997) Red Hat OpenShift Dev Spaces 3.31.1 RHEL 10 Container Release.	October 28, 2026
RHSA-2026:91967	(RHSA-2026:91967) A Subscription Management tool for finding and reporting Red Hat product usage	October 28, 2026
RHSA-2026:91958	(RHSA-2026:91958) Important: osbuild-composer security update	October 28, 2026
RHSA-2026:91845	(RHSA-2026:91845) Important: mrtg security update	October 28, 2026

By the Year

In 2026 there have been 4813 vulnerabilities in Red Hat with an average score of 7.3 out of ten. Last year, in 2025 Red Hat had 1202 security vulnerabilities published. That is, 3611 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.43.

Year	Vulnerabilities	Average Score
2026	4813	7.30
2025	1202	6.87
2024	1705	6.82
2023	1208	6.74
2022	1362	6.97
2021	1123	6.54
2020	664	6.37
2019	772	6.93
2018	762	7.17

It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-84725	Oct 28, 2026	when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528 when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.	Jboss Enterprise Application Platform
CVE-2026-93523	Oct 28, 2026	A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context. A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
CVE-2026-93522	Oct 28, 2026	A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context. A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.
CVE-2026-93521	Oct 28, 2026	A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context. A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
CVE-2026-93520	Oct 28, 2026	A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context. A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
CVE-2026-93519	Oct 28, 2026	A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context. A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
CVE-2026-93518	Oct 28, 2026	An integer truncation issue in XkbResizeKeyType() An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.
CVE-2026-93517	Oct 28, 2026	A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.
CVE-2026-93516	Oct 28, 2026	X.org X Server XWayland UAF before 21.1.25/24.1.14 A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.
CVE-2026-88812	Oct 27, 2026	XKB Double Free in X.Org X Server <21.1.25 & XWayland <24.1.14 A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
CVE-2026-65627	Oct 26, 2026	Memory exhaustion via inflated DEFLATE in erlang-jose 1.0.01.11.12 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call. Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users. This issue affects jose: from 1.0.0 before 1.11.13.
CVE-2026-92171	Oct 26, 2026	Infinispan Operator TLS Password Exposure via CLI Args A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/<pid>/cmdline`, and frequently captured in audit/event logs.	Jboss Data Grid
CVE-2026-95620	Oct 23, 2026	Qt QNetworkAccessManager HTTP/2 Use-After-Free Crash Vulnerability A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2 client support of the Qt Network module allows a malicious or compromised HTTP/2 server to cause the client application to crash, affecting availability.
CVE-2026-85518	Oct 21, 2026	OpenSCAP Path Traversal in SDS Decompression (CVE-2026-85518) A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.	Enterprise Linux (RHEL) Hummingbird
CVE-2026-97313	Oct 21, 2026	BIND Recursion Assertion Failure (DoS) 9.169.18.50, 9.209.20.29, 9.219.21.26 A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-96888	Oct 21, 2026	BIND 9 Resolver Abort on Redirect & QNAME-MIN Strict (9.16-9.21) A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-94300	Oct 21, 2026	BIND 9 named GSS-TSIG Replay Causing Memory Corruption <9.18.50,9.21.26> Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-19630	Oct 21, 2026	BIND 9 DoS via Unbounded DNS Message Processing (9.11.0-9.21.26) In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-17557	Oct 21, 2026	Authenticated SSRF & Secret Leak in lm-evaluation-harness (RedHat OpenShift AI) A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.	Openshift Ai
CVE-2026-92824	Oct 21, 2026	Red Hat libmodulemd OOB Read in YAML Serialization (CVE-2026-92824) A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-92823	Oct 21, 2026	Red Hat libmodulemd DoS via Unbounded Decompression Size A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-92822	Oct 21, 2026	libmodulemd DOS via unlimited nested YAML xmd recursion A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-92539	Oct 20, 2026	Grafana Enterprise SCIM IDOR crossorg user edits A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
CVE-2026-93446	Oct 20, 2026	Apache Tomcat TLS1.3 Fail Incomplete Cleanup (pre-11.0.27/10.1.61/9.0.123) Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
CVE-2026-88041	Oct 20, 2026	Tomcat Trailer Info Leak 911 (CVE-2026-88041) Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
CVE-2026-80353	Oct 20, 2026	Apache Tomcat 9 TOCTOU UNIX Domain Socket Access via APR/Native (Pre-9.0.123) Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.
CVE-2026-74049	Oct 20, 2026	Apache Tomcat EAR Vulnerability (CVE-2026-74049) Fixed in 11.0.27/10.1.61/9.0.123 Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
CVE-2026-74048	Oct 20, 2026	Apache Tomcat CVE-2026-74048 FIPS mode fails, JSSE fallback Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
CVE-2026-16460	Oct 19, 2026	bootc/ostree: Bypass Image Signature Validation on Reboot A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-16487	Oct 19, 2026	Bootc SigPolicy Flaw Enables Unsigned Image Exec as Root	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-89096	Oct 16, 2026	nfs-utils rpc.statd DoS via Memory Leak A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.	Enterprise Linux (RHEL) Openshift
CVE-2026-89088	Oct 16, 2026	Heap-based Buffer Overflow in libparted's FAT16 Resize Logic A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).	Enterprise Linux (RHEL)
CVE-2026-89085	Oct 16, 2026	Parted Heap Overflow in FAT32 Image Processing (DoS) A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.	Enterprise Linux (RHEL)
CVE-2026-17591	Oct 16, 2026	libarchive UAF in archive_entry_copy_mac_metadata (CVE-2026-17591) A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.	Enterprise Linux (RHEL) Hummingbird
CVE-2026-62438	Oct 16, 2026	GIMP Integer Overflow in Image Decompressor Enables DoS/memory Disclosure A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.	Enterprise Linux (RHEL)
CVE-2026-62439	Oct 16, 2026	GIMP file-pvr plugin integer overflow heap buf overflow A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.	Enterprise Linux (RHEL)
CVE-2026-68498	Oct 16, 2026	Jackson Core 2.16+ Memory Exhaustion via Oversized JSON Property Names StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input Reader, String or char[] sources, all served by ReaderBasedJsonParser that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name up to maxStringLength characters has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration. Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] for example an HTTP request body already read into a String rather than from raw UTF-8 bytes. This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.
CVE-2026-85977	Oct 16, 2026	libtirpc Denial of Service via Unbounded PMAPPROC_DUMP Decoding A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-85231	Oct 16, 2026	libtirpc DoS via Unbounded Memory Allocation by Oversized RPCSEC_GSS Data A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-89098	Oct 16, 2026	Local DoS via fsidd assertion failure in nfs-utils A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.	Enterprise Linux (RHEL) Openshift
CVE-2026-86047	Oct 16, 2026	SQL Injection via Unquoted Identifiers in MariaDB SHOW CREATE MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-85745	Oct 16, 2026	MariaDB ST_Area WKB Buffer Overflow (10.6.110.6.28, 10.11.19, 11.4.13) MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-85746	Oct 16, 2026	MariaDB ST_AsText Buffer Overflow 10.628 & 10.1119 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-97380	Oct 16, 2026	MariaDB Server <=13.0.2 GRANT PROXY empty password auth bypass MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-85985	Oct 16, 2026	MariaDB CONNECT UDF RCE via file-access plugin; fixed up to 13.0.2 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-84823	Oct 15, 2026	WildFly Path Traversal in take-snapshot Allows Monitor Role to Read Config A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.	Enterprise Linux (RHEL) Jboss Fuse Jboss Enterprise Application Platform And others...
CVE-2026-87029	Oct 15, 2026	Undici 7.15-7.30.0/8.0-8.12.1: decompress interceptor crash (async exception) undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.
CVE-2026-87018	Oct 15, 2026	undici HTTP client crash via TLS1.2 renegotiation (v4.2.18.12.1) undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.
CVE-2026-92707	Oct 15, 2026	DoS via PrimitiveObjectFormatter in MessagePack for C# before 2.5.303/3.1.9 MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.
CVE-2026-61702	Oct 15, 2026	CUPS 2.4.20 Path Traversal via IPP natural-language in copy_banner() OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.