Red Hat Linux OS and other open source products

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Red Hat product.

RSS Feeds for Red Hat security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Red Hat Sorted by Most Security Vulnerabilities since 2018

Red Hat Enterprise Linux (RHEL)2679 vulnerabilities

Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.

Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.

Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop

Red Hat Enterprise Linux Eus1126 vulnerabilities

Red Hat Enterprise Linux Server Aus884 vulnerabilities

Red Hat Enterprise Linux Server Tus701 vulnerabilities

Red Hat Openshift603 vulnerabilities

Red Hat Rhel Eus577 vulnerabilities

Red Hat Rhel E4s483 vulnerabilities

Red Hat Rhel Tus431 vulnerabilities

Red Hat Rhel Aus422 vulnerabilities

Red Hat Enterprise Linux Server Eus414 vulnerabilities

Red Hat Satellite362 vulnerabilities

Red Hat Rhel Eus Long Life339 vulnerabilities

Red Hat Rhel Els327 vulnerabilities

Red Hat Openshift Ai324 vulnerabilities

Red Hat Jboss Enterprise Application Platform296 vulnerabilities

Red Hat Hummingbird279 vulnerabilities

Red Hat Openstack277 vulnerabilities

Red Hat Jbosseapxp233 vulnerabilities

Red Hat Openshift Container Platform230 vulnerabilities

Red Hat Build Keycloak216 vulnerabilities

Red Hat Jboss Fuse208 vulnerabilities

Red Hat Ansible Automation Platform202 vulnerabilities

Red Hat Rhivos199 vulnerabilities

Red Hat Jboss Data Grid196 vulnerabilities

Red Hat Single Sign On172 vulnerabilities

Red Hat Enterprise Linux Ai154 vulnerabilities

Red Hat Quay154 vulnerabilities

Red Hat Openshift Devspaces152 vulnerabilities

Red Hat Acm133 vulnerabilities

Red Hat Rhdh124 vulnerabilities

Red Hat Software Collections123 vulnerabilities

Red Hat Keycloak123 vulnerabilities

Red Hat Cryostat120 vulnerabilities

Red Hat Virtualization115 vulnerabilities

Red Hat Discovery114 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems108 vulnerabilities

Red Hat Ai Inference Server105 vulnerabilities

Red Hat Kafka104 vulnerabilities

Red Hat Enterprise Linux Power Little Endian103 vulnerabilities

Red Hat Jboss Enterprise Bpms Platform100 vulnerabilities

Red Hat Trusted Artifact Signer96 vulnerabilities

Red Hat Single Sign On95 vulnerabilities

Red Hat Openshift Pipelines94 vulnerabilities

Red Hat Ceph Storage93 vulnerabilities

Red Hat Apache Camel Hawtio92 vulnerabilities

Red Hat Advanced Cluster Security91 vulnerabilities

Red Hat Multicluster Engine91 vulnerabilities

Red Hat Container Native Virtualization90 vulnerabilities

Red Hat Enterprise Linux Power Little Endian Eus88 vulnerabilities

Red Hat Amq Streams84 vulnerabilities

Red Hat Service Mesh84 vulnerabilities

Red Hat Camel Spring Boot84 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems Eus82 vulnerabilities

Red Hat Logging82 vulnerabilities

Red Hat Rhui79 vulnerabilities

Red Hat Openshift Data Foundation78 vulnerabilities

Red Hat Amq Broker77 vulnerabilities

Red Hat Ansible Portal77 vulnerabilities

Red Hat Openshift Lightspeed75 vulnerabilities

Red Hat Serverless75 vulnerabilities

Red Hat Enterprise Linux Scientific Computing71 vulnerabilities

Red Hat Ansible Automation Platform Developer71 vulnerabilities

Red Hat Migration Toolkit Applications70 vulnerabilities

Red Hat Ansible Tower69 vulnerabilities

Red Hat Openshift Gitops68 vulnerabilities

Red Hat Quarkus63 vulnerabilities

Red Hat Ansible Automation Platform Inside62 vulnerabilities

Red Hat 3scale Amp62 vulnerabilities

Red Hat Enterprise Linux Server Power Little Endian Update Services Sap Solutions61 vulnerabilities

Red Hat Apache Camel Spring Boot58 vulnerabilities

Red Hat Podman Desktop58 vulnerabilities

Red Hat Apicurio Registry56 vulnerabilities

Red Hat Libvirt55 vulnerabilities

Red Hat Rhmt55 vulnerabilities

Red Hat Service Registry54 vulnerabilities

Red Hat Camel Quarkus54 vulnerabilities

Red Hat Virtualization Host53 vulnerabilities

Red Hat Satellite Capsule53 vulnerabilities

Red Hat Multicluster Globalhub53 vulnerabilities

Red Hat Openshift Distributed Tracing52 vulnerabilities

Red Hat Network Observ Optr51 vulnerabilities

Red Hat Directory Server47 vulnerabilities

Red Hat Enterprise Linux Power Big Endian45 vulnerabilities

Red Hat Jboss Core Services45 vulnerabilities

Red Hat Insights Proxy44 vulnerabilities

Red Hat Enterprise Linux Server Update Services Sap Solutions43 vulnerabilities

Red Hat Enterprise Linux For Real Time43 vulnerabilities

Red Hat Http Server42 vulnerabilities

Red Hat Ansible42 vulnerabilities

Red Hat Enterprise Linux For Arm 6442 vulnerabilities

Red Hat Enterprise Linux Aus41 vulnerabilities

Red Hat Confidential Compute Attestation41 vulnerabilities

Recent Red Hat Security Advisories

Advisory	Title	Published
RHSA-2026:55180	(RHSA-2026:55180) Red Hat Hardened Images RPMs Security Update	August 15, 2026
RHSA-2026:55142	(RHSA-2026:55142) Red Hat Hardened Images RPMs bug fix and enhancement update	August 15, 2026
RHSA-2026:54776	(RHSA-2026:54776) Important: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.3.GA)	August 13, 2026
RHSA-2026:54773	(RHSA-2026:54773) Red Hat build of OpenTelemetry 3.10.2 release	August 13, 2026
RHSA-2026:54760	(RHSA-2026:54760) A Subscription Management tool for finding and reporting Red Hat product usage	August 13, 2026
RHSA-2026:54752	(RHSA-2026:54752) Important: gstreamer1-plugins-bad-free security update	August 13, 2026
RHSA-2026:54667	(RHSA-2026:54667) Important: freerdp security update	August 13, 2026
RHSA-2026:54666	(RHSA-2026:54666) Important: yelp security update	August 13, 2026
RHSA-2026:54665	(RHSA-2026:54665) Important: gstreamer1-plugins-bad-free security update	August 13, 2026
RHSA-2026:54664	(RHSA-2026:54664) Important: gstreamer1-plugins-bad-free security update	August 13, 2026

By the Year

In 2026 there have been 2724 vulnerabilities in Red Hat with an average score of 7.2 out of ten. Last year, in 2025 Red Hat had 1169 security vulnerabilities published. That is, 1555 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.34.

Year	Vulnerabilities	Average Score
2026	2724	7.19
2025	1169	6.85
2024	1691	6.82
2023	1206	6.74
2022	1362	6.96
2021	1123	6.61
2020	664	6.39
2019	772	6.98
2018	760	7.16

It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-74247	Aug 14, 2026	Red Hat Quay SSRF via Build API (FEATURE_BUILD_SUPPORT) A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network addresses. Such an action could lead to the disclosure of sensitive internal information.	Openshift Update Service Quay
CVE-2026-74245	Aug 14, 2026	Red Hat Quay: Unauth File ID Hijack Logs Info Disclosure A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.	Openshift Update Service Quay
CVE-2026-74244	Aug 14, 2026	Unauth Webhook Forgery in Red Hat Quay Stripe Handler (CVE-2026-74244) A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header. Successful exploitation can lead to the unauthorized resetting of a namespace's build quota to its maximum and trigger unsolicited billing emails to namespace administrators.	Openshift Update Service Quay
CVE-2026-74243	Aug 14, 2026	Red Hat Quay: Unauth flood & path traversal on Clair via SECURITY_SCANNER_V4_PSK A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.	Openshift Update Service Quay
CVE-2026-74242	Aug 14, 2026	Quay: UUID-based Notification Config Disclosure (CVE-2026-74242) A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. This vulnerability also allows them to trigger test notifications for another repository. This could lead to unauthorized information disclosure and potential misuse of notification services.	Openshift Update Service Quay
CVE-2026-74241	Aug 14, 2026	LDAP Filter Injection in Red Hat Quay Auth A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP) authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral Directory Name (DN). This could also potentially influence which DN is used for password binding in multi-domain Active Directory environments.	Openshift Update Service Quay
CVE-2026-74240	Aug 14, 2026	Red Hat Quay JWT Audit/Claim Bypass via SSO A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.	Openshift Update Service Quay
CVE-2026-13002	Aug 14, 2026	dnsmasq dnssec.c infinite loop DoS (CVE-2026-13002) A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An attacker who controls any DNSSEC-signed zone can hang the dnsmasq process with a single crafted response, killing all DNS resolution for its clients.	Enterprise Linux (RHEL) Openshift
CVE-2026-19879	Aug 14, 2026	Encoding Truncation in Undertow Response Header Writes A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.	Camel Spring Boot Enterprise Linux (RHEL) Jboss Enterprise Application Platform And others...
CVE-2026-58224	Aug 14, 2026	Samba CTDB Protocol Packet Bounds Checking Flaw (CVE-2026-58224) A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents.	Enterprise Linux (RHEL) Openshift
CVE-2026-19617	Aug 14, 2026	Libdm Recursion DoS via LVM Metadata (CVE-2026-19617) A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-19730	Aug 13, 2026	Podman 5.8.x Quadlet Replace Truncation Flaw Security Data Leakage The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE\|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker. The vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE\|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).	Ansible Automation Platform Enterprise Linux (RHEL) Hummingbird And others...
CVE-2026-73266	Aug 13, 2026	Auth Tenant Label Mod in MCE ClusterClaims-Controller A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.	Multicluster Engine
CVE-2026-48702	Aug 13, 2026	Rekor is a software supply chain transparency log Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` `fetchExternalEntities()` `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.
CVE-2026-49478	Aug 13, 2026	Fulcio <=1.8.5: SSRF via cross-host redirects + K8s SA token leakage Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.
CVE-2026-73584	Aug 13, 2026	A flaw was found in sblim-sfcb A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system.	Enterprise Linux (RHEL)
CVE-2026-73583	Aug 13, 2026	A flaw was found in sblim-sfcb A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access, leading to the termination of the provider-manager process and a denial of service. This could also potentially result in limited unintended information disclosure.	Enterprise Linux (RHEL)
CVE-2026-73585	Aug 13, 2026	A flaw was found in sblim-cmpi-base A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.	Enterprise Linux (RHEL)
CVE-2026-18728	Aug 13, 2026	open-iscsi iscsiuio Int Underflow in DHCP Parsing Leads to DoS A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.	Enterprise Linux (RHEL)
CVE-2026-71846	Aug 12, 2026	CR Priv Escalation in Red Hat Insights-Client Enables Cluster-Wide Secret Read A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that a compromise of the insights-client pod or ServiceAccount token would grant an attacker read access to all Secrets across the hub cluster, including managed-cluster kubeconfigs and other sensitive credentials.	Acm
CVE-2026-71469	Aug 12, 2026	Red Hat search-v2-api Unauthenticated Cache DoS via Unbounded tokenReviews A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).	Acm
CVE-2026-71471	Aug 12, 2026	RCE via Collector.ImageOverride in acm-search-v2 (Red Hat) A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attacker to execute commands and potentially access sensitive information across the entire fleet of managed clusters.	Acm
CVE-2026-71473	Aug 12, 2026	Red Hat Search-v2-Operator: Arbitrary Config Injection & Container Image Replacement A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially compromising its integrity.	Acm
CVE-2026-18727	Aug 12, 2026	IPv6 DHCPv6 Integer Underflow in open-iscsi iscsiuio Enables Unauth DoS A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.	Enterprise Linux (RHEL)
CVE-2026-18726	Aug 12, 2026	DoS via ICMPv6 RA in open-iscsi iscsiuio daemon A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.	Enterprise Linux (RHEL)
CVE-2026-19654	Aug 12, 2026	rsyslogd Crash via Unauth Remote in Optional imptcp Module A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected.	Enterprise Linux (RHEL)
CVE-2026-19130	Aug 12, 2026	Red Hat MCE provider-credential-controller Auth Bypass via Label Manipulation A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.	Multicluster Engine
CVE-2026-13622	Aug 12, 2026	KubeVirt virt-handler Symlink Followfor-Privilege Escalation A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.	Container Native Virtualization
CVE-2026-72508	Aug 12, 2026	RHACM multicloud-operators-subscription Confused Deputy Privilege Escalation A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.	Acm
CVE-2026-73433	Aug 12, 2026	GStreamer avidemux OOB Read/Write Vulnerability pre-1.28.6 A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also write beyond the buffer end. Confirmed impacts include heap out-of-bounds read, out-of-bounds write, heap information disclosure (adjacent data appearing in parsed metadata), and application crash/denial of service. The avidemux element is auto-plugged by playbin, decodebin, and gst-discoverer, so opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).	Enterprise Linux (RHEL)
CVE-2026-73434	Aug 12, 2026	GStreamer gst-plugins-good (avidemux) OOB Read before 1.28.6 A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can crash the application (denial of service). Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072).	Enterprise Linux (RHEL)
CVE-2026-73268	Aug 12, 2026	ClusterCurator-Controller: RCE via Job Injection in Red Hat Multicluster Engine A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.	Multicluster Engine
CVE-2026-73269	Aug 12, 2026	RedHat OpenShift PrivEsc via ClusterCurator: CVE-2026-73269 A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.	Multicluster Engine
CVE-2026-19548	Aug 12, 2026	UAF in GNU ld (binutils) add_archive_element Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-18663	Aug 12, 2026	RedHat 389-Ds DoubleFree in get_ldapmessage_controls_ext via Session Tracking Control A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service.	Directory Server Enterprise Linux (RHEL)
CVE-2026-64927	Aug 12, 2026	Red Hat multicloud-operators-channel Secret Manipulation (CVE-2026-64927) A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system.	Acm
CVE-2026-73122	Aug 12, 2026	Info Disclosure via Unauthorized Secrets in RHACM Channel Operator A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This could lead to significant information disclosure.	Acm
CVE-2026-66878	Aug 12, 2026	Secret Disclosure via Channel.Spec.SecretRef.Namespace in multicloud-operators-subscription A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.	Acm
CVE-2026-70398	Aug 12, 2026	RHACM multicloud-integrations Authenticated Token Disclosure via GitOpsCluster A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects.	Acm
CVE-2026-72526	Aug 12, 2026	Red Hat OpenShift GitOps multicloud-integrations: OCM Annotation Validation Flaw A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters.	Acm
CVE-2026-19550	Aug 11, 2026	FreeIPA PrivEsc via trust-fetch-domains: Unauthorized Trust Refresh A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.	Enterprise Linux (RHEL)
CVE-2026-71474	Aug 11, 2026	Insights-client Exposes Pull-Secret via Pod Log Leakage A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.	Acm
CVE-2026-71468	Aug 11, 2026	RedHat ACM Search API RHEL9: Improper Bearer Token Reuse in Federation Cache A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure.	Acm
CVE-2026-71475	Aug 11, 2026	RedHat Insights Client URL Path Injection via Unencoded ClusterID A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access.	Acm
CVE-2026-71845	Aug 11, 2026	insights-client logs CCX_TOKEN to pod logs (CVE-2026-71845) A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.	Acm
CVE-2026-71467	Aug 11, 2026	Red Hat Search-v2-API Auth Bypass via WebSocket Upgrade header A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and access federated search results across all configured remote managed hubs, leading to information disclosure.	Acm
CVE-2026-66808	Aug 11, 2026	Aug 2026: Microsoft SharePoint Server Remote Code Execution Vulnerability Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-66805	Aug 11, 2026	Aug 2026: Microsoft SharePoint Server Remote Code Execution Vulnerability Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-73089	Aug 11, 2026	Browserslist 4.28.7 OOM via unbounded cache in index.js Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `<year>-<month>-<day>` queries, to bypass the caller-controlled BROWSERSLIST_DISABLE_CACHE mitigation and cause linear memory growth followed by an out-of-memory process crash. This issue is fixed in version 4.28.7.
CVE-2026-62909	Aug 11, 2026	Aug 2026: .NET Elevation of Privilege Vulnerability Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.