Red Hat Linux OS and other open source products

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Red Hat product.

RSS Feeds for Red Hat security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Red Hat Sorted by Most Security Vulnerabilities since 2018

Red Hat Enterprise Linux (RHEL)2889 vulnerabilities

Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.

Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.

Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop

Red Hat Enterprise Linux Eus1210 vulnerabilities

Red Hat Enterprise Linux Server Aus884 vulnerabilities

Red Hat Enterprise Linux Server Tus701 vulnerabilities

Red Hat Openshift689 vulnerabilities

Red Hat Rhel Eus674 vulnerabilities

Red Hat Rhel E4s577 vulnerabilities

Red Hat Rhel Tus496 vulnerabilities

Red Hat Rhel Aus471 vulnerabilities

Red Hat Enterprise Linux Server Eus414 vulnerabilities

Red Hat Satellite389 vulnerabilities

Red Hat Rhel Eus Long Life388 vulnerabilities

Red Hat Openshift Ai367 vulnerabilities

Red Hat Rhel Els363 vulnerabilities

Red Hat Hummingbird350 vulnerabilities

Red Hat Jboss Enterprise Application Platform330 vulnerabilities

Red Hat Openstack306 vulnerabilities

Red Hat Build Keycloak267 vulnerabilities

Red Hat Jbosseapxp255 vulnerabilities

Red Hat Ansible Automation Platform248 vulnerabilities

Red Hat Jboss Fuse243 vulnerabilities

Red Hat Single Sign On238 vulnerabilities

Red Hat Openshift Container Platform230 vulnerabilities

Red Hat Jboss Data Grid216 vulnerabilities

Red Hat Rhivos199 vulnerabilities

Red Hat Openshift Devspaces161 vulnerabilities

Red Hat Acm161 vulnerabilities

Red Hat Quay159 vulnerabilities

Red Hat Enterprise Linux Ai157 vulnerabilities

Red Hat Kafka142 vulnerabilities

Red Hat Rhdh128 vulnerabilities

Red Hat Discovery126 vulnerabilities

Red Hat Software Collections123 vulnerabilities

Red Hat Keycloak123 vulnerabilities

Red Hat Cryostat121 vulnerabilities

Red Hat Ai Inference Server116 vulnerabilities

Red Hat Virtualization115 vulnerabilities

Red Hat Camel Spring Boot111 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems108 vulnerabilities

Red Hat Ansible Automation Platform Developer104 vulnerabilities

Red Hat Enterprise Linux Power Little Endian103 vulnerabilities

Red Hat Rhui103 vulnerabilities

Red Hat Jboss Enterprise Bpms Platform102 vulnerabilities

Red Hat Ceph Storage100 vulnerabilities

Red Hat Apache Camel Hawtio99 vulnerabilities

Red Hat Multicluster Engine99 vulnerabilities

Red Hat Trusted Artifact Signer96 vulnerabilities

Red Hat Openshift Pipelines95 vulnerabilities

Red Hat Single Sign On95 vulnerabilities

Red Hat Amq Broker94 vulnerabilities

Red Hat Ansible Automation Platform Inside94 vulnerabilities

Red Hat Container Native Virtualization93 vulnerabilities

Red Hat Logging92 vulnerabilities

Red Hat Advanced Cluster Security91 vulnerabilities

Red Hat Quarkus91 vulnerabilities

Red Hat Enterprise Linux Power Little Endian Eus88 vulnerabilities

Red Hat Service Mesh86 vulnerabilities

Red Hat Amq Streams86 vulnerabilities

Red Hat Openshift Data Foundation84 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems Eus82 vulnerabilities

Red Hat Camel Quarkus79 vulnerabilities

Red Hat Ansible Portal78 vulnerabilities

Red Hat Apicurio Registry77 vulnerabilities

Red Hat Serverless76 vulnerabilities

Red Hat Openshift Lightspeed75 vulnerabilities

Red Hat Http Server74 vulnerabilities

Red Hat Migration Toolkit Applications72 vulnerabilities

Red Hat Cert Manager72 vulnerabilities

Red Hat Enterprise Linux Scientific Computing71 vulnerabilities

Red Hat Ansible Tower69 vulnerabilities

Red Hat Satellite Capsule68 vulnerabilities

Red Hat Openshift Gitops68 vulnerabilities

Red Hat 3scale Amp64 vulnerabilities

Red Hat Enterprise Linux Server Power Little Endian Update Services Sap Solutions61 vulnerabilities

Red Hat Podman Desktop58 vulnerabilities

Red Hat Apache Camel Spring Boot58 vulnerabilities

Red Hat Rhmt57 vulnerabilities

Red Hat Debezium55 vulnerabilities

Red Hat Multicluster Globalhub55 vulnerabilities

Red Hat Libvirt55 vulnerabilities

Red Hat Directory Server55 vulnerabilities

Red Hat Service Registry54 vulnerabilities

Red Hat Satellite Utils54 vulnerabilities

Red Hat Virtualization Host53 vulnerabilities

Red Hat Openshift Distributed Tracing52 vulnerabilities

Red Hat Network Observ Optr51 vulnerabilities

Red Hat Jboss Core Services48 vulnerabilities

Red Hat Enterprise Linux Power Big Endian45 vulnerabilities

Red Hat Confidential Compute Attestation45 vulnerabilities

Red Hat Insights Proxy44 vulnerabilities

Red Hat Enterprise Linux Server Update Services Sap Solutions43 vulnerabilities

Red Hat Enterprise Linux For Real Time43 vulnerabilities

Recent Red Hat Security Advisories

Advisory	Title	Published
RHSA-2026:88248	(RHSA-2026:88248) Important: expat security update	October 22, 2026
RHSA-2026:88229	(RHSA-2026:88229) Important: httpd security update	October 22, 2026
RHSA-2026:88211	(RHSA-2026:88211) Moderate: openssh security update	October 22, 2026
RHSA-2026:88207	(RHSA-2026:88207) Important: iperf3 security update	October 22, 2026
RHSA-2026:88206	(RHSA-2026:88206) Important: kernel security update	October 22, 2026
RHSA-2026:88204	(RHSA-2026:88204) Important: kernel-rt security update	October 22, 2026
RHSA-2026:88199	(RHSA-2026:88199) LVMS 4.12 Bug Fix and Enhancement update	October 22, 2026
RHSA-2026:88198	(RHSA-2026:88198) Red Hat Developer Hub 1.10.6 release.	October 22, 2026
RHSA-2026:88189	(RHSA-2026:88189) Important: grafana-pcp security update	October 22, 2026
RHSA-2026:88188	(RHSA-2026:88188) Important: grafana security update	October 22, 2026

By the Year

In 2026 there have been 4717 vulnerabilities in Red Hat with an average score of 7.3 out of ten. Last year, in 2025 Red Hat had 1200 security vulnerabilities published. That is, 3517 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.42.

Year	Vulnerabilities	Average Score
2026	4717	7.29
2025	1200	6.87
2024	1705	6.82
2023	1208	6.74
2022	1362	6.97
2021	1123	6.54
2020	664	6.37
2019	772	6.93
2018	762	7.17

It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-85518	Oct 21, 2026	OpenSCAP Path Traversal in SDS Decompression (CVE-2026-85518) A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.	Enterprise Linux (RHEL) Hummingbird
CVE-2026-97313	Oct 21, 2026	BIND Recursion Assertion Failure (DoS) 9.169.18.50, 9.209.20.29, 9.219.21.26 A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no". This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-96888	Oct 21, 2026	BIND 9 Resolver Abort on Redirect & QNAME-MIN Strict (9.16-9.21) A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-94300	Oct 21, 2026	BIND 9 named GSS-TSIG Replay Causing Memory Corruption <9.18.50,9.21.26> Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-19630	Oct 21, 2026	BIND 9 DoS via Unbounded DNS Message Processing (9.11.0-9.21.26) In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
CVE-2026-17557	Oct 21, 2026	Authenticated SSRF & Secret Leak in lm-evaluation-harness (RedHat OpenShift AI) A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.	Openshift Ai
CVE-2026-92824	Oct 21, 2026	Red Hat libmodulemd OOB Read in YAML Serialization (CVE-2026-92824) A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-92822	Oct 21, 2026	libmodulemd DOS via unlimited nested YAML xmd recursion A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-92823	Oct 21, 2026	Red Hat libmodulemd DoS via Unbounded Decompression Size A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-92539	Oct 20, 2026	Grafana Enterprise SCIM IDOR crossorg user edits A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise instances with SCIM enabled are affected.
CVE-2026-93446	Oct 20, 2026	Apache Tomcat TLS1.3 Fail Incomplete Cleanup (pre-11.0.27/10.1.61/9.0.123) Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
CVE-2026-88041	Oct 20, 2026	Tomcat Trailer Info Leak 911 (CVE-2026-88041) Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
CVE-2026-80353	Oct 20, 2026	Apache Tomcat 9 TOCTOU UNIX Domain Socket Access via APR/Native (Pre-9.0.123) Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.
CVE-2026-74049	Oct 20, 2026	Apache Tomcat EAR Vulnerability (CVE-2026-74049) Fixed in 11.0.27/10.1.61/9.0.123 Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
CVE-2026-74048	Oct 20, 2026	Apache Tomcat CVE-2026-74048 FIPS mode fails, JSSE fallback Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
CVE-2026-16460	Oct 19, 2026	bootc/ostree: Bypass Image Signature Validation on Reboot A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-16487	Oct 19, 2026	Bootc SigPolicy Flaw Enables Unsigned Image Exec as Root	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-89096	Oct 16, 2026	nfs-utils rpc.statd DoS via Memory Leak A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.	Enterprise Linux (RHEL) Openshift
CVE-2026-89088	Oct 16, 2026	Heap-based Buffer Overflow in libparted's FAT16 Resize Logic A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).	Enterprise Linux (RHEL)
CVE-2026-89085	Oct 16, 2026	Parted Heap Overflow in FAT32 Image Processing (DoS) A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption.	Enterprise Linux (RHEL)
CVE-2026-17591	Oct 16, 2026	libarchive UAF in archive_entry_copy_mac_metadata (CVE-2026-17591) A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.	Enterprise Linux (RHEL) Hummingbird
CVE-2026-62438	Oct 16, 2026	GIMP Integer Overflow in Image Decompressor Enables DoS/memory Disclosure A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.	Enterprise Linux (RHEL)
CVE-2026-62439	Oct 16, 2026	GIMP file-pvr plugin integer overflow heap buf overflow A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.	Enterprise Linux (RHEL)
CVE-2026-68498	Oct 16, 2026	Jackson Core 2.16+ Memory Exhaustion via Oversized JSON Property Names StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength (default 100,000,000 characters) that bounds ordinary string values. For parsers built over character input Reader, String or char[] sources, all served by ReaderBasedJsonParser that bound is not applied while the name is being accumulated. The code path instead re-uses the string-value length check, which is roughly 2000x larger by default. In the character-input slow path, ReaderBasedJsonParser._parseName2() accumulates the name into the TextBuffer and, when a segment fills, calls TextBuffer.finishCurrentSegment(), which validates only maxStringLength. The correct check, StreamReadConstraints.validateNameLength(int), is reached afterwards in CharsToNameCanonicalizer.findSymbol(), once the entire name has been scanned to its closing quote. By that point the full name up to maxStringLength characters has already been buffered in memory. A remote attacker who can have a single sufficiently long JSON Object property name parsed through this path can force allocation on the order of 100,000,000 characters (approximately 200 MB, with segment bookkeeping pushing real peak usage higher) before any StreamConstraintsException is thrown, instead of the approximately 50,000-character (about 100 KB) bound the API promises. Repeating this across concurrent requests can exhaust the heap and crash the process. No authentication or user interaction is required. Because StreamReadConstraints.maxDocumentLength is disabled by default (-1), nothing else bounds the token first, so the issue is exploitable under default configuration. Byte-input parsers are not affected: UTF8StreamJsonParser, UTF8DataInputJsonParser and the non-blocking (async) parsers re-validate maxNameLength on every growth of the name-decode buffer via ParserBase._growNameDecodeBuffer(), rejecting an oversized name after allocating only tens of kilobytes. Applications are exposed when untrusted JSON is parsed from a String, Reader or char[] for example an HTTP request body already read into a String rather than from raw UTF-8 bytes. This issue affects com.fasterxml.jackson.core:jackson-core from 2.16.0 and tools.jackson.core:jackson-core from 3.0.0. Releases before 2.16.0 are not affected, because StreamReadConstraints.maxNameLength was first introduced in jackson-core 2.16.0.
CVE-2026-85977	Oct 16, 2026	libtirpc Denial of Service via Unbounded PMAPPROC_DUMP Decoding A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-85231	Oct 16, 2026	libtirpc DoS via Unbounded Memory Allocation by Oversized RPCSEC_GSS Data A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.	Enterprise Linux (RHEL) Hummingbird Openshift And others...
CVE-2026-89098	Oct 16, 2026	Local DoS via fsidd assertion failure in nfs-utils A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.	Enterprise Linux (RHEL) Openshift
CVE-2026-86047	Oct 16, 2026	SQL Injection via Unquoted Identifiers in MariaDB SHOW CREATE MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-85745	Oct 16, 2026	MariaDB ST_Area WKB Buffer Overflow (10.6.110.6.28, 10.11.19, 11.4.13) MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-97380	Oct 16, 2026	MariaDB Server <=13.0.2 GRANT PROXY empty password auth bypass MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-85985	Oct 16, 2026	MariaDB CONNECT UDF RCE via file-access plugin; fixed up to 13.0.2 MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
CVE-2026-84823	Oct 15, 2026	WildFly Path Traversal in take-snapshot Allows Monitor Role to Read Config A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.	Enterprise Linux (RHEL) Jboss Fuse Jboss Enterprise Application Platform And others...
CVE-2026-87029	Oct 15, 2026	Undici 7.15-7.30.0/8.0-8.12.1: decompress interceptor crash (async exception) undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading.
CVE-2026-87018	Oct 15, 2026	undici HTTP client crash via TLS1.2 renegotiation (v4.2.18.12.1) undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it.
CVE-2026-92707	Oct 15, 2026	DoS via PrimitiveObjectFormatter in MessagePack for C# before 2.5.303/3.1.9 MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.
CVE-2026-61702	Oct 15, 2026	CUPS 2.4.20 Path Traversal via IPP natural-language in copy_banner() OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20.
CVE-2026-55453	Oct 15, 2026	CUPS 2.4.20+ Fix: CRLF Injection in Ipp Backend leaks PPD keyword OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20.
CVE-2026-55480	Oct 15, 2026	CUPS <2.4.20 Unpredictable TempDir PPD Overwrite (root) OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20.
CVE-2026-55467	Oct 15, 2026	CUPS 2.4.20 Control-Char Injection via Fax Queue OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.
CVE-2026-85634	Oct 15, 2026	WildFly Core Path Traversal in ContentRepositoryImpl Enables PrivEsc A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role.	Jboss Fuse Jboss Enterprise Application Platform Jbosseapxp And others...
CVE-2026-92982	Oct 15, 2026	Ansible Operator Plugins: Jinja2 Template Injection Enables ClusterWide PrivEsc A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.	Migration Toolkit Applications Rhmt Migration Toolkit Virtualization And others...
CVE-2026-99999	Oct 15, 2026	Linux Kernel IPv4 Checksum Validation Vulnerability (CVE-2026-99999) In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
CVE-2026-18660	Oct 15, 2026	CaseSensitive Host Whitelist/Blacklist in Eclipse Jetty 12.1.11/11.0.32 In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
CVE-2026-86849	Oct 14, 2026	DPDK vhost-crypto Integer Overflow, Host Buffer Overrun A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.	Enterprise Linux (RHEL) Openshift Openstack And others...
CVE-2026-86856	Oct 14, 2026	DPDK nfp vDPA Driver Buffer Overflow via Excess Virtqueues A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.	Enterprise Linux (RHEL) Openshift Openstack And others...
CVE-2026-86847	Oct 14, 2026	DPDK vhost-crypto Uninitialized Next Pointer Crash in Write-Back Chain A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.	Enterprise Linux (RHEL) Openshift Openstack And others...
CVE-2026-86846	Oct 14, 2026	DPDK vhost-crypto OOB Write via Unchecked Avail-Ring Index A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.	Enterprise Linux (RHEL) Openshift Openstack And others...
CVE-2026-86845	Oct 14, 2026	DPDK vhost-crypto Use-after-Free via stale session pointer A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.	Enterprise Linux (RHEL) Openshift Openstack And others...
CVE-2026-86566	Oct 14, 2026	DPDK lib/vhost RX Descriptor Underflow Causes VDS in OVSDPDK A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.	Enterprise Linux (RHEL) Openshift Openstack And others...
CVE-2026-86848	Oct 14, 2026	DPDK lib/vhost vhost-crypto Indirect-Descriptor OOB via double-fetch A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.	Enterprise Linux (RHEL) Openshift Openstack And others...