Red Hat Linux OS and other open source products

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Red Hat product.

RSS Feeds for Red Hat security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Red Hat Sorted by Most Security Vulnerabilities since 2018

Red Hat Enterprise Linux (RHEL)2932 vulnerabilities

Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.

Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.

Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop

Red Hat Enterprise Linux Eus1221 vulnerabilities

Red Hat Enterprise Linux Server Aus884 vulnerabilities

Red Hat Openshift708 vulnerabilities

Red Hat Enterprise Linux Server Tus701 vulnerabilities

Red Hat Rhel Eus692 vulnerabilities

Red Hat Rhel E4s597 vulnerabilities

Red Hat Rhel Tus508 vulnerabilities

Red Hat Rhel Aus493 vulnerabilities

Red Hat Enterprise Linux Server Eus414 vulnerabilities

Red Hat Rhel Eus Long Life410 vulnerabilities

Red Hat Satellite391 vulnerabilities

Red Hat Rhel Els379 vulnerabilities

Red Hat Openshift Ai373 vulnerabilities

Red Hat Hummingbird354 vulnerabilities

Red Hat Jboss Enterprise Application Platform338 vulnerabilities

Red Hat Openstack316 vulnerabilities

Red Hat Build Keycloak272 vulnerabilities

Red Hat Jbosseapxp260 vulnerabilities

Red Hat Ansible Automation Platform248 vulnerabilities

Red Hat Jboss Fuse246 vulnerabilities

Red Hat Single Sign On245 vulnerabilities

Red Hat Openshift Container Platform230 vulnerabilities

Red Hat Jboss Data Grid217 vulnerabilities

Red Hat Rhivos199 vulnerabilities

Red Hat Enterprise Linux Ai167 vulnerabilities

Red Hat Openshift Devspaces162 vulnerabilities

Red Hat Acm161 vulnerabilities

Red Hat Quay161 vulnerabilities

Red Hat Kafka142 vulnerabilities

Red Hat Rhdh128 vulnerabilities

Red Hat Discovery126 vulnerabilities

Red Hat Software Collections123 vulnerabilities

Red Hat Keycloak123 vulnerabilities

Red Hat Cryostat121 vulnerabilities

Red Hat Ai Inference Server117 vulnerabilities

Red Hat Virtualization115 vulnerabilities

Red Hat Camel Spring Boot112 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems108 vulnerabilities

Red Hat Ceph Storage106 vulnerabilities

Red Hat Rhui105 vulnerabilities

Red Hat Ansible Automation Platform Developer104 vulnerabilities

Red Hat Enterprise Linux Power Little Endian103 vulnerabilities

Red Hat Jboss Enterprise Bpms Platform102 vulnerabilities

Red Hat Apache Camel Hawtio99 vulnerabilities

Red Hat Multicluster Engine99 vulnerabilities

Red Hat Trusted Artifact Signer96 vulnerabilities

Red Hat Amq Broker95 vulnerabilities

Red Hat Openshift Pipelines95 vulnerabilities

Red Hat Single Sign On95 vulnerabilities

Red Hat Ansible Automation Platform Inside94 vulnerabilities

Red Hat Container Native Virtualization93 vulnerabilities

Red Hat Advanced Cluster Security92 vulnerabilities

Red Hat Logging92 vulnerabilities

Red Hat Quarkus92 vulnerabilities

Red Hat Amq Streams89 vulnerabilities

Red Hat Enterprise Linux Power Little Endian Eus88 vulnerabilities

Red Hat Service Mesh86 vulnerabilities

Red Hat Openshift Data Foundation84 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems Eus82 vulnerabilities

Red Hat Camel Quarkus80 vulnerabilities

Red Hat Ansible Portal78 vulnerabilities

Red Hat Apicurio Registry78 vulnerabilities

Red Hat Serverless76 vulnerabilities

Red Hat Openshift Lightspeed75 vulnerabilities

Red Hat Http Server74 vulnerabilities

Red Hat Migration Toolkit Applications72 vulnerabilities

Red Hat Cert Manager72 vulnerabilities

Red Hat Enterprise Linux Scientific Computing71 vulnerabilities

Red Hat Openshift Gitops69 vulnerabilities

Red Hat Ansible Tower69 vulnerabilities

Red Hat Satellite Capsule68 vulnerabilities

Red Hat 3scale Amp64 vulnerabilities

Red Hat Enterprise Linux Server Power Little Endian Update Services Sap Solutions61 vulnerabilities

Red Hat Apache Camel Spring Boot58 vulnerabilities

Red Hat Podman Desktop58 vulnerabilities

Red Hat Rhmt57 vulnerabilities

Red Hat Debezium56 vulnerabilities

Red Hat Libvirt55 vulnerabilities

Red Hat Multicluster Globalhub55 vulnerabilities

Red Hat Directory Server55 vulnerabilities

Red Hat Service Registry54 vulnerabilities

Red Hat Satellite Utils54 vulnerabilities

Red Hat Virtualization Host53 vulnerabilities

Red Hat Openshift Distributed Tracing52 vulnerabilities

Red Hat Network Observ Optr51 vulnerabilities

Red Hat Jboss Core Services49 vulnerabilities

Red Hat Enterprise Linux Power Big Endian45 vulnerabilities

Red Hat Confidential Compute Attestation45 vulnerabilities

Red Hat Insights Proxy44 vulnerabilities

Red Hat Enterprise Linux Server Update Services Sap Solutions43 vulnerabilities

Red Hat Enterprise Linux For Real Time43 vulnerabilities

Recent Red Hat Security Advisories

Advisory	Title	Published
RHSA-2026:94567	(RHSA-2026:94567) Important: libXtst security update	November 3, 2026
RHSA-2026:94558	(RHSA-2026:94558) Critical: kernel-rt security, bug fix, and enhancement update	November 3, 2026
RHSA-2026:94557	(RHSA-2026:94557) Critical: fence-agents security update	November 3, 2026
RHSA-2026:93622	(RHSA-2026:93622) Important: Red Hat JBoss Web Server 7.0.3 release and security update	November 3, 2026
RHSA-2026:94532	(RHSA-2026:94532) Red Hat OpenShift Data Foundation 4.18.31 security, enhancement & bug fix update	November 3, 2026
RHSA-2026:94531	(RHSA-2026:94531) OpenShift Container Platform 5.0 NUMA resources operator extras update	November 3, 2026
RHSA-2026:94528	(RHSA-2026:94528) OpenShift Container Platform 5.0 CNF vRAN extras topology aware lifecycle manager update	November 3, 2026
RHSA-2026:94523	(RHSA-2026:94523) Critical: fence-agents security update	November 3, 2026
RHSA-2026:94514	(RHSA-2026:94514) Important: freerdp security, bug fix, and enhancement update	November 3, 2026
RHSA-2026:94510	(RHSA-2026:94510) Important: freerdp security update	November 3, 2026

By the Year

In 2026 there have been 5001 vulnerabilities in Red Hat with an average score of 7.3 out of ten. Last year, in 2025 Red Hat had 1205 security vulnerabilities published. That is, 3796 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.41.

Year	Vulnerabilities	Average Score
2026	5001	7.28
2025	1205	6.87
2024	1705	6.82
2023	1208	6.74
2022	1362	6.98
2021	1123	6.54
2020	664	6.37
2019	772	6.93
2018	762	7.17

It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-121259	Nov 03, 2026	GStreamer gst-plugins-bad JPEG2000 Int Overflow (CVE-2026-121259) A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service.	Enterprise Linux (RHEL)
CVE-2026-119843	Nov 03, 2026	GStreamer gst-plugins-good FLV Demuxer Buffer Size Validation Bypass A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a specially crafted FLV media file that, when opened or streamed by a GStreamer-based application, triggers an assertion failure or a process crash, leading to denial of service.	Enterprise Linux (RHEL)
CVE-2026-120971	Nov 03, 2026	RESTEasy 7.0.2 Final - Unhandled Exception Leak via Default Mapper A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can trigger such an exception may obtain information contained in that message. The behavior was reproduced with RESTEasy 7.0.2.Final.	Camel Quarkus Apicurio Registry Debezium And others...
CVE-2026-120831	Nov 03, 2026	Queue Pointer Corruption in libslirp => Host DoS via Burst Traffic A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.	Enterprise Linux (RHEL) Openshift
CVE-2026-120830	Nov 03, 2026	libslirp ICMP error out-of-bounds heap read in Red Hat QEMU A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.	Enterprise Linux (RHEL) Openshift
CVE-2026-120740	Nov 02, 2026	Red Hat Hivex OOB Read via Malformed Registry Hive A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash, resulting in a Denial of Service (DoS).	Enterprise Linux (RHEL)
CVE-2026-120194	Oct 31, 2026	json-glib Denial of Service via Infinite Loop in JSONPath Slice Evaluator A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.	Enterprise Linux (RHEL) Openshift
CVE-2026-119842	Oct 30, 2026	GStreamer gst-plugins-base: MicroDVD Subtitle Parser NULL Deref Crash A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.	Enterprise Linux (RHEL)
CVE-2026-119727	Oct 30, 2026	GStreamer gst-plugins-bad H.265 SCC Parser Integer Underflow A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact.	Enterprise Linux (RHEL)
CVE-2026-119729	Oct 30, 2026	GStreamer AV1 LEB128 Integer Overflow in Variable-Length Integer Parser A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.	Enterprise Linux (RHEL)
CVE-2026-119728	Oct 30, 2026	NULL PTR Deref in gst-plugins-bad H.264 Parser Causes DoS A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.	Enterprise Linux (RHEL)
CVE-2026-119777	Oct 30, 2026	GStreamer gst-plugins-bad H.266 Parser Stack Overflow via Integer Overflow A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application.	Enterprise Linux (RHEL)
CVE-2026-118593	Oct 30, 2026	Red Hat Enterprise Linux 9 Kernel: local_bh imbalance in seg6_input_core() leads to softirq starvati A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.	Enterprise Linux (RHEL) Openshift
CVE-2026-91920	Oct 30, 2026	Undertow ChunkReader overflow permits HTTP request smuggling A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.	Camel Spring Boot Enterprise Linux (RHEL) Jboss Fuse And others...
CVE-2026-118959	Oct 30, 2026	A flaw was found in the required action provider mechanism of Keycloak A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.	Build Keycloak Red Hat Single Sign On
CVE-2026-92092	Oct 29, 2026	RCE through Unverified Script Download in OpenShift Ansible Installer A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.	Openshift
CVE-2026-118764	Oct 29, 2026	minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Starting in 7.0.0 and prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.
CVE-2026-118425	Oct 29, 2026	Keycloak Secure-Redirect-URIs-Enforcer Bypass via DNS Loopback Hostname A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.	Build Keycloak Red Hat Single Sign On
CVE-2026-93009	Oct 29, 2026	dnsmasq DHCPv6 Hostname OOB Read on Local Network A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.	Ceph Storage Enterprise Linux (RHEL) Openshift And others...
CVE-2026-93010	Oct 29, 2026	dnsmasq DHCP Leasequery Allows Local Network to Leak Lease Data A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.	Ceph Storage Enterprise Linux (RHEL) Openshift And others...
CVE-2026-93006	Oct 29, 2026	dnsmasq TFTP cache reuse allows malicious PXE boot A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.	Ceph Storage Enterprise Linux (RHEL) Openshift And others...
CVE-2026-93007	Oct 29, 2026	DNSMASQ TCP Connection Flood causing DNS Service Denial A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.	Ceph Storage Enterprise Linux (RHEL) Openshift And others...
CVE-2026-93011	Oct 29, 2026	dnsmasq DNSSEC buffer overrun, allows heap metadata overwrite A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.	Ceph Storage Enterprise Linux (RHEL) Openshift And others...
CVE-2026-93008	Oct 29, 2026	dnsmasq CNAME Cache Pollution via Unverified DNS Response A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.	Ceph Storage Enterprise Linux (RHEL) Openshift And others...
CVE-2026-85498	Oct 29, 2026	Polkit Int Underflow in Auth Agent Causing DoS A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).	Hummingbird Enterprise Linux (RHEL) Openshift And others...
CVE-2026-117688	Oct 29, 2026	Keycloak Client Reg. Secret Disclosure via Vault Ref A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.	Build Keycloak Red Hat Single Sign On
CVE-2026-117627	Oct 29, 2026	A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.	Build Keycloak Red Hat Single Sign On
CVE-2026-114488	Oct 29, 2026	Wildfly IIOP EJB Auth Bypass via CSIv2 ITTPrincipalName A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB.	Jboss Fuse Jboss Enterprise Application Platform Jbosseapxp And others...
CVE-2026-19610	Oct 29, 2026	Red Hat JBoss EAP platform-mbean RBAC bypass reads JVM config A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control (RBAC) checks. This allows an authenticated user with low-privileged access, such as the Monitor role, to view sensitive system properties and JVM configuration details that should be restricted.	Jboss Enterprise Application Platform Jbosseapxp Red Hat Single Sign On And others...
CVE-2026-15564	Oct 29, 2026	Wildfly IIOP Deserialization Before Auth Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.	Jboss Enterprise Application Platform
CVE-2026-86983	Oct 28, 2026	Apple Swift-Crypto 5.0.3 VOPRF Input Length Bypass A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.
CVE-2026-117574	Oct 28, 2026	A flaw was found in ai-gateway-payload-processing A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from the shared store, it injects the target tenant's application programming interface (API) keys into the request. This flaw allows an attacker to perform unauthorized requests and consume another tenant's large language model (LLM) resources and quotas.	Openshift Ai
CVE-2026-13451	Oct 28, 2026	KServe SSRF via Malicious storageUri in InferenceService Resource A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `storageUri`. This Server-Side Request Forgery (SSRF) vulnerability allows the `storage-initializer` init container to issue arbitrary outbound HTTP/HTTPS requests from inside the cluster. This can lead to information disclosure, including credential theft for the node's Identity and Access Management (IAM) role or access to internal cluster services.	Openshift Ai
CVE-2026-84725	Oct 28, 2026	Red Hat JBoss EAP: Unauth RCE via JDKBridge CDR URL when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.	Jboss Enterprise Application Platform
CVE-2026-116794	Oct 28, 2026	russh is a Rust SSH client and server library that includes an SSH agent protocol implementation russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::try_sign path in russh/src/keys/agent/server.rs recognizes SSH_AGENT_CONSTRAIN_CONFIRM but returns a hard-coded successful result instead of calling Agent::confirm. In applications that override Agent::confirm to require user approval or another policy check, a process that can reach the agent socket, including the remote side of a forwarded agent, can use a key added through ssh-add -c without that check and can authenticate or sign data as the user while the key remains loaded. The separate Agent::confirm_request hook still runs for every signing request, so checks implemented there remain effective, and implementations that retain the default always-successful Agent::confirm do not lose an approval check through this regression. This issue is fixed in version 0.65.0.
CVE-2026-93523	Oct 28, 2026	X.Org X Server <21.1.15 Heap Buffer Overflow via XIPassiveUngrabDevice A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
CVE-2026-93522	Oct 28, 2026	X.Org X Server <=21.1.15: CPU-to-FBO Heap Overflow A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.
CVE-2026-93521	Oct 28, 2026	X.Org X Server <2.1.25 Buffer Overflow in RandR ChangeProviderProperty A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.
CVE-2026-93520	Oct 28, 2026	X.org XServer Heap Overflow XkbAllocNames/ChangeKeycodeRange pre 2.1.25 A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
CVE-2026-93519	Oct 28, 2026	X.Org X Server Buffer Overrun in XFIXES (21.1.25) A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.
CVE-2026-93518	Oct 28, 2026	X Server Heap BOF via Integer Truncation in XkbResizeKeyType() (pre-21.1.25) An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.
CVE-2026-93517	Oct 28, 2026	X.org X Server: Heap Buffer Overflow in GLX RenderLarge before 21.1.25 A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.
CVE-2026-93516	Oct 28, 2026	X.org X Server XWayland UAF before 21.1.25/24.1.14 A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X Clients to crash the X server or potentially execute code in X server context.
CVE-2026-118370	Oct 28, 2026	libexpat <=2.9.0 Signed Integer Overflow in storeAtts() (OOB Write) libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
CVE-2026-116696	Oct 27, 2026	Memory Growth via Repeated SSH_AGENT_CONSTRAIN_CONFIRM in russh <0.65.0 russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.
CVE-2026-88812	Oct 27, 2026	XKB Double Free in X.Org X Server <21.1.25 & XWayland <24.1.14 A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.
CVE-2026-65627	Oct 26, 2026	Memory exhaustion via inflated DEFLATE in erlang-jose 1.0.01.11.12 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip.erl decompresses the DEFLATE-compressed plaintext of a JWE that carries the optional zip: DEF header by calling zlib:inflate/2 on the entire attacker-controlled stream, with no bound on the output size or the inflation ratio. Raw DEFLATE reaches ratios around 1000:1 on highly repetitive input, so a few-kilobyte token inflates to hundreds of megabytes or gigabytes in a single call. Decompression runs automatically during decryption through jose_jwe:block_decrypt/2 (JOSE.JWE.block_decrypt/2 in Elixir), before the recipient can inspect or reject the payload. With the common asymmetric key-management algorithms (RSA-OAEP, ECDH-ES) an attacker needs only the recipient's public key to craft such a token, so no authentication or secret material is required. A single small token can exhaust the node's memory and crash the BEAM, denying service to all users. This issue affects jose: from 1.0.0 before 1.11.13.
CVE-2026-92171	Oct 26, 2026	Infinispan Operator TLS Password Exposure via CLI Args A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments (`-tls_keystore_password`, `-tls_truststore_password`). Container args are stored in the Pod spec and visible to any principal with `get pods` permission in the namespace (no `get secrets` required), to node-level processes via `/proc/<pid>/cmdline`, and frequently captured in audit/event logs.	Jboss Data Grid
CVE-2026-115557	Oct 24, 2026	Python SSL Module Denylist of Compromised Certs Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration.
CVE-2026-105482	Oct 23, 2026	A flaw in Node.js DNS resolution A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.