Red Hat Linux OS and other open source products
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Red Hat product.
RSS Feeds for Red Hat security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Red Hat Sorted by Most Security Vulnerabilities since 2018
Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.
Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.
Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop
Recent Red Hat Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:57118 | (RHSA-2026:57118) Moderate: OpenJDK 25.0.4.1 Security Update for Windows Builds | August 27, 2026 |
| RHSA-2026:60486 | (RHSA-2026:60486) Important: kernel security update | August 27, 2026 |
| RHSA-2026:60485 | (RHSA-2026:60485) Important: kernel security update | August 27, 2026 |
| RHSA-2026:60394 | (RHSA-2026:60394) Moderate: libxml2 security update | August 27, 2026 |
| RHSA-2026:60438 | (RHSA-2026:60438) Important: kernel-rt security update | August 27, 2026 |
| RHSA-2026:60437 | (RHSA-2026:60437) Important: kernel security update | August 27, 2026 |
| RHSA-2026:60428 | (RHSA-2026:60428) Important: iscsi-initiator-utils security, bug fix, and enhancement update | August 26, 2026 |
| RHSA-2026:60427 | (RHSA-2026:60427) Important: iscsi-initiator-utils security update | August 26, 2026 |
| RHSA-2026:60385 | (RHSA-2026:60385) Important: isns-utils security update | August 26, 2026 |
| RHSA-2026:60383 | (RHSA-2026:60383) Important: bind security update | August 26, 2026 |
By the Year
In 2026 there have been 2966 vulnerabilities in Red Hat with an average score of 7.2 out of ten. Last year, in 2025 Red Hat had 1171 security vulnerabilities published. That is, 1795 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.35.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2966 | 7.20 |
| 2025 | 1171 | 6.85 |
| 2024 | 1692 | 6.82 |
| 2023 | 1206 | 6.75 |
| 2022 | 1362 | 6.96 |
| 2021 | 1123 | 6.61 |
| 2020 | 664 | 6.39 |
| 2019 | 772 | 6.98 |
| 2018 | 760 | 7.16 |
It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-18393 | Aug 28, 2026 |
A flaw was found in FFmpegA flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution. |
Enterprise Linux Ai
Openshift Ai
|
| CVE-2026-80179 | Aug 27, 2026 |
jwcrypto JWE Deserialization Memory Overrun DoSA flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values. |
Ansible Automation Platform
Enterprise Linux (RHEL)
Openshift Ai
And others... |
| CVE-2026-81893 | Aug 27, 2026 |
gdk-pixbuf 2.26.4+ OOB Write via Malformed JPEG ICC ProfileA flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4 |
Enterprise Linux (RHEL)
|
| CVE-2026-5680 | Aug 27, 2026 |
Undertow WebSocket DoS via PerMessageDeflate Buffer DoublingA flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application. |
Camel Spring Boot
Apache Camel Hawtio
Jboss Data Grid
And others... |
| CVE-2026-78002 | Aug 27, 2026 |
rsyslog RainerScript replace() Heap Overflow (DoS)A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system. |
Enterprise Linux (RHEL)
|
| CVE-2026-81668 | Aug 27, 2026 |
Katello API Auth Bypass: Unauthorized Cross-Org Content View Filter AccessA flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration. |
Satellite
|
| CVE-2026-81658 | Aug 27, 2026 |
Foreman: Unauthorized Disclosure via Audited Template Revision EndpointA flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup. |
Satellite
|
| CVE-2026-80158 | Aug 26, 2026 |
Unlogged Kerberos Bind Password Leak via Ansible ipa_getkeytabA flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw <value>), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access. |
Ceph Storage
Openstack
|
| CVE-2026-79902 | Aug 26, 2026 |
Unbounded VLA stack allocation in GIMP's Seattle FilmWorks pluginA flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service. |
Enterprise Linux (RHEL)
|
| CVE-2026-79654 | Aug 26, 2026 |
Katello CVH API Auth Bypass: Unauthorized Org AccessA flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps. |
Satellite
|
| CVE-2026-80185 | Aug 25, 2026 |
BlueZ sdp-xml.c Type Confusion in RegisterProfile() leads to Local DoSBlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash bluetoothd. |
Enterprise Linux (RHEL)
|
| CVE-2026-80186 | Aug 25, 2026 |
BlueZ stack-based buffer overflow via crafted EIR packet (DoS/Arbitrary exec)A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution. |
Enterprise Linux (RHEL)
|
| CVE-2026-80101 | Aug 25, 2026 |
Heap OOB Read in GIMP file-xwd Plugin (Image Width/Bytes-Per-Line Validation)A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service, or a limited information disclosure of heap memory contents into the produced image. |
Enterprise Linux (RHEL)
|
| CVE-2026-77680 | Aug 25, 2026 |
LibSoup O(N2) Range Header CPU ExhaustionAn algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup_message_headers_get_ranges_internal() in libsoup/soup-message-headers.c, but the coalescing loop still removes merged ranges using g_array_remove_index() for each coalesced element. Because GArray is contiguous, each mid-array removal performs an O(N) memmove. When many identical satisfiable ranges are supplied (for example bytes=0-0 repeated thousands of times), the loop performs O(N²) work coalescing them into a single range. The vulnerable path is reachable server-side from handle_partial_get() in libsoup/server/http1/soup-server-message-io-http1.c when a SoupServer handler returns HTTP 200 with a non-empty body. No authentication is required. The number of ranges is bounded only by the maximum request header size (~100 KiB), allowing roughly 25,000 ranges per request. Reporter measurements on libsoup HEAD containing the CVE-2025-32907 fix show ~90 ms single-core CPU per such request at the wire maximum, blocking the server's event loop for that duration. This is a CPU exhaustion / availability issue only. No memory corruption or information disclosure occurs. Affected: libsoup versions containing the CVE-2025-32907 fix but not merge request !550. Fixed upstream: MR !550 merged 2026-08-20, replacing per-element removal with O(N) in-place compaction and rejecting Range headers requesting more than 200 ranges. Upstream report: https://gitlab.gnome.org/GNOME/libsoup/-/issues/538 Related: CVE-2025-32907 |
Enterprise Linux (RHEL)
|
| CVE-2026-79992 | Aug 25, 2026 |
Emacs TRAMP Local Exec via Malformed FilenamesA flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution. |
Enterprise Linux (RHEL)
|
| CVE-2026-79717 | Aug 25, 2026 |
SSRF in galaxy_ng Ansible Galaxy plugin via avatar URLA server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata endpoints. A background worker fetches that URL without checking the destination, which lets the attacker probe internal services and enumerate reachable IP addresses. The HTTP client is also configured without an overall timeout, so a slow or non-responsive target can pin workers and cause a denial of service. |
Ansible Automation Platform
|
| CVE-2026-79655 | Aug 25, 2026 |
Sos Clean Path Traversal Enables Arbitrary File Creation with Root PrivilegesA flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root. |
Enterprise Linux (RHEL)
|
| CVE-2026-79652 | Aug 25, 2026 |
Keycloak JWT Bearer Grant Bypass of User ConsentA flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-78701 | Aug 25, 2026 |
389-ds Base SASL UNBIND DoS via Remote Authenticated StallingA flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server. |
Directory Server
Enterprise Linux (RHEL)
|
| CVE-2026-78322 | Aug 25, 2026 |
File-roller Stack Buffer Overflow via Malicious Archive PathA flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller. |
Enterprise Linux (RHEL)
|
| CVE-2026-17113 | Aug 24, 2026 |
CRI-O Env Variable Crash via Nil Envs Causes Go Runtime PanicA flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted. |
Openshift
|
| CVE-2026-78475 | Aug 24, 2026 |
Unbounded Stack Allocation in GIMP file-pix (ESM) PluginA flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file. |
Enterprise Linux (RHEL)
|
| CVE-2026-78465 | Aug 24, 2026 |
Heap-Based Buffer Overflow in GIMP file-pcx Plugin (32bit)A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service. |
Enterprise Linux (RHEL)
|
| CVE-2026-19685 | Aug 24, 2026 |
NetworkManager Vulnerable 802-1x.ca-path CA Path Bypass (CVE-2026-19685)NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point. |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-71366 | Aug 24, 2026 |
SSRF in Red Hat AWX Notif Backends: Webhook, Mattermost, Rocket.Chat, GrafanaA server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates pointing to internal or loopback addresses, causing the AWX control node to issue HTTP requests to services that are not externally accessible. Additionally, the webhook notification backend follows HTTP redirects and resends configured Basic Authentication credentials to redirect targets regardless of host change, allowing an attacker to exfiltrate notification credentials by redirecting to an attacker-controlled host. The Grafana backend sends its API key in the Authorization header to the configured target URL. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-71364 | Aug 24, 2026 |
AWX Project Archive Path Traversal for Arbitrary File WriteA path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. A malicious archive containing members with path traversal components can write files to arbitrary locations on the execution node's filesystem outside the intended project directory. An attacker who controls the archive content, either through a compromised upstream source, a malicious archive URL, or a man-in-the-middle attack on a plain HTTP connection, can achieve arbitrary file writes as the user performing the extraction, potentially leading to remote code execution through mechanisms such as cron files, SSH authorized keys, or playbook content injection. |
Ansible Automation Platform
Ansible Automation Platform Developer
Ansible Automation Platform Inside
And others... |
| CVE-2026-78367 | Aug 24, 2026 |
rpmbuild Macro Injection via Tar Member NameA vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb). |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-78376 | Aug 24, 2026 |
WebKitGTK UAF via improper memory handling in WebKitGTKA flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. |
Enterprise Linux (RHEL)
|
| CVE-2026-78323 | Aug 24, 2026 |
Trust Anchor Validation Flaw in JSS JSSTrustManagerA flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS connections. In non-default configurations where certificate revocation checking is disabled, this could allow a man-in-the-middle attacker to forge certificates accepted by PKI client connections. |
Certificate System
Enterprise Linux (RHEL)
|
| CVE-2026-74581 | Aug 21, 2026 |
Linux Kernel: Stale IPv6 Route Leak Due to fib6 Rule SuppressionIn the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one. |
|
| CVE-2026-73267 | Aug 21, 2026 |
MCE clusterclaims-controller DoS via unauthorized ManagedCluster deletionA flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters. |
Multicluster Engine
|
| CVE-2026-73137 | Aug 20, 2026 |
RHACM multicloud-operators-subscription: privilege escalation allows exfilA flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository. This can lead to the exfiltration of credentials from arbitrary namespace Secrets, resulting in information disclosure. |
Acm
|
| CVE-2026-67567 | Aug 20, 2026 |
Arbitrary k8s resource deployment via HelmRelease multicloud-operator-subscriptionA flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise. |
Acm
|
| CVE-2026-66788 | Aug 20, 2026 |
Lighthouse Namespace Injection for Unauthorized EndpointSlice/ServiceImportA flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces like kube-system and openshift-*. This could lead to privilege escalation or other forms of system compromise within the cluster. |
Acm
|
| CVE-2026-66787 | Aug 20, 2026 |
RedHat AMK Lighthouse IP validation flaw enabling MITMA flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints. This enables a remote attacker to conduct transparent Man-in-the-Middle (MITM) attacks on cross-cluster service communications, potentially leading to unauthorized information disclosure and data manipulation. |
Acm
|
| CVE-2026-66785 | Aug 20, 2026 |
Red Hat Submariner Unauthorized Network Traffic Redirection VulnerabilityA flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for these arbitrary ranges from peer clusters will be rerouted through the attacker's tunnel, potentially leading to unauthorized information disclosure or network disruption. |
Acm
|
| CVE-2026-18299 | Aug 20, 2026 |
GStreamer rtpsbcdepay UAF RCE VulnerabilityGStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29787. |
|
| CVE-2026-18298 | Aug 20, 2026 |
GStreamer png Plugin Heap Overflow RCEGStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29581. |
|
| CVE-2026-18297 | Aug 20, 2026 |
GStreamer OGG Stack Buffer Overflow RCEGStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29584. |
|
| CVE-2026-18296 | Aug 20, 2026 |
GStreamer MRF Heap Overflow RCE via File ParsingGStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29608. |
|
| CVE-2026-18295 | Aug 20, 2026 |
GStreamer MRF OOB Write RCE VulnerabilityGStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of MRF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29510. |
|
| CVE-2026-77176 | Aug 20, 2026 |
Kata Containers: Host Operator Elevates Priv via CreateContainer Mount ValidationA flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or enabling the acceptance of attacker-controlled input. |
Openshift
|
| CVE-2026-19611 | Aug 20, 2026 |
WildFly Elytron Unicode Normalization Weakens Password HashingA flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access. |
Camel Quarkus
Debezium
Build Keycloak
And others... |
| CVE-2026-73199 | Aug 20, 2026 |
Null Pointer Deref in FreeIPA ipa-enrollment SLAPI (DoS)A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, an attacker can trigger a server crash, potentially causing a denial of service. |
Enterprise Linux (RHEL)
|
| CVE-2026-11861 | Aug 20, 2026 |
Privilege Escalation: PAC Omission in FreeIPA AD TrustA flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain. |
Enterprise Linux (RHEL)
|
| CVE-2026-73198 | Aug 20, 2026 |
FreeIPA Memory Exhaustion DoS via Large /ipa/i18n_messages RequestA flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition. |
Enterprise Linux (RHEL)
|
| CVE-2026-13097 | Aug 20, 2026 |
FreeIPA Kerberos Principal Uniqueness Flaw Priv EscalationA privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise. |
Enterprise Linux (RHEL)
|
| CVE-2026-73196 | Aug 20, 2026 |
FreeIPA CPU DoS via Oversized OTP KeyA flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service. |
Enterprise Linux (RHEL)
|
| CVE-2026-73197 | Aug 20, 2026 |
FreeIPA DoS via Oversized POST: /ipa/migration/migration.pyA flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service. |
Enterprise Linux (RHEL)
|
| CVE-2026-18917 | Aug 20, 2026 |
libvirt NodeGetFreePages Int Overflow (Privilege Escalation)A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation. |
Enterprise Linux (RHEL)
Enterprise Linux Nvidia
|