RH
Product
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
On CISA KEVExploited in the wild
292
CVEs
2
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 47High 209Medium 40Low 2
Watch
Add Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6746 | 7.5 | Apr 21 | Use-after-free in the DOM: Core & HTML component Affected: All versions, or not specified |
| CVE-2026-40164 | 7.5 | Apr 13 | jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed Affected: All versions, or not specified |
| CVE-2026-32280 | 7.5 | Apr 8 | Unexpected work during chain building in crypto/x509 Affected: All versions, or not specified |
| CVE-2026-32283 | 7.5 | Apr 8 | Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls Affected: All versions, or not specified |
| CVE-2026-35092 | 7.5 | Apr 1 | Corosync: corosync: denial of service via integer overflow in join message validation Affected: All versions, or not specified |
| CVE-2026-5201 | 7.5 | Mar 31 | Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image Affected: All versions, or not specified |
| CVE-2026-33984 | 7.5 | Mar 30 | FreeRDP: ClearCodec resize_vbar_entry() Heap OOB Write Affected: All versions, or not specified |
| CVE-2026-5121 | 7.5 | Mar 30 | Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing Affected: All versions, or not specified |
| CVE-2026-27858 | 7.5 | Mar 27 | Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory Affected: All versions, or not specified |
| CVE-2026-27857 | 7.5 | Mar 27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage Affected: All versions, or not specified |
| CVE-2025-59032 | 7.5 | Mar 27 | ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response Affected: All versions, or not specified |
| CVE-2026-33526 | 7.5 | Mar 26 | Squid vulnerable to Denial of Service in ICP Request handling Affected: All versions, or not specified |
| CVE-2026-32748 | 7.5 | Mar 26 | Squid has Denial of Service in ICP Response handling Affected: All versions, or not specified |
| CVE-2026-1519 | 7.5 | Mar 25 | Excessive NSEC3 iterations cause high CPU load during insecure delegation validation Affected: All versions, or not specified |
| CVE-2026-4699 | 7.5 | Mar 24 | Incorrect boundary conditions in the Layout: Text and Fonts component Affected: All versions, or not specified |
| CVE-2026-4697 | 7.5 | Mar 24 | Incorrect boundary conditions in the Audio/Video: Web Codecs component Affected: All versions, or not specified |
| CVE-2026-4695 | 7.5 | Mar 24 | Incorrect boundary conditions in the Audio/Video: Web Codecs component Affected: All versions, or not specified |
| CVE-2026-4694 | 7.5 | Mar 24 | Incorrect boundary conditions, integer overflow in the Graphics component Affected: All versions, or not specified |
| CVE-2026-4693 | 7.5 | Mar 24 | Incorrect boundary conditions in the Audio/Video: Playback component Affected: All versions, or not specified |
| CVE-2026-4686 | 7.5 | Mar 24 | Incorrect boundary conditions in the Graphics: Canvas2D component Affected: All versions, or not specified |
| CVE-2026-4685 | 7.5 | Mar 24 | Incorrect boundary conditions in the Graphics: Canvas2D component Affected: All versions, or not specified |
| CVE-2026-4684 | 7.5 | Mar 24 | Race condition, use-after-free in the Graphics: WebRender component Affected: All versions, or not specified |
| CVE-2026-4424 | 7.5 | Mar 19 | Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing Affected: All versions, or not specified |
| CVE-2026-27135 | 7.5 | Mar 18 | nghttp2 Denial of service: Assertion failure due to the missing state validation Affected: All versions, or not specified |
| CVE-2026-30922 | 7.5 | Mar 18 | pyasn1 Vulnerable to Denial of Service via Unbounded Recursion Affected: All versions, or not specified |
| CVE-2026-3497 | 7.5 | Mar 12 | Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions Affected: All versions, or not specified |
| CVE-2025-6021 | 7.5 | Jun 12 | Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 Affected: All versions, or not specified |
| CVE-2024-8176 | 7.5 | Mar 14 | Libexpat: expat: improper restriction of xml entity expansion depth in libexpat Affected: All versions, or not specified |
| CVE-2024-12087 | 7.5 | Jan 14 | Rsync: path traversal vulnerability in rsync Affected: All versions, or not specified |
| CVE-2024-12085 | 7.5 | Jan 14 | Rsync: info leak via uninitialized stack contents Affected: All versions, or not specified |
| CVE-2026-42246 | 7.4 | May 9 | net-imap vulnerable to STARTTLS stripping via invalid response timing Affected: All versions, or not specified |
| CVE-2026-42011 | 7.4 | May 7 | Gnutls: gnutls: security bypass due to incorrect name constraint handling Affected: All versions, or not specified |
| CVE-2026-3833 | 7.4 | Apr 30 | Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison Affected: All versions, or not specified |
| CVE-2026-4371 | 7.4 | Mar 24 | Out of bounds read in IMAP parsing Affected: All versions, or not specified |
| CVE-2025-13947 | 7.4 | Dec 3 | Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop Affected: All versions, or not specified |
| CVE-2024-11614 | 7.4 | Dec 18 | Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library Affected: All versions, or not specified |
| CVE-2026-16527 | 7.3 | Jul 30 | Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules Affected: All versions, or not specified |
| CVE-2026-12912 | 7.3 | Jun 29 | Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image Affected: All versions, or not specified |
| CVE-2026-11837 | 7.3 | Jun 10 | Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown Affected: All versions, or not specified |
| CVE-2026-48962 | 7.3 | May 27 | IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob Affected: All versions, or not specified |
| CVE-2026-8947 | 7.3 | May 19 | Use-after-free in the DOM: Bindings (WebIDL) component Affected: All versions, or not specified |
| CVE-2026-8090 | 7.3 | May 7 | Use-after-free in the DOM: Networking component Affected: All versions, or not specified |
| CVE-2026-7323 | 7.3 | Apr 28 | Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 Affected: All versions, or not specified |
| CVE-2026-7322 | 7.3 | Apr 28 | Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 Affected: All versions, or not specified |
| CVE-2026-6753 | 7.3 | Apr 21 | Incorrect boundary conditions in the WebRTC component Affected: All versions, or not specified |
| CVE-2026-6752 | 7.3 | Apr 21 | Incorrect boundary conditions in the WebRTC component Affected: All versions, or not specified |
| CVE-2026-6751 | 7.3 | Apr 21 | Uninitialized memory in the Audio/Video: Web Codecs component Affected: All versions, or not specified |
| CVE-2026-33412 | 7.3 | Mar 24 | Vim affected by Command injection via newline in glob() Affected: All versions, or not specified |
| CVE-2026-59691 | 7.1 | Jul 9 | Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer Affected: All versions, or not specified |
| CVE-2026-52722 | 7.1 | Jun 15 | Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling Affected: All versions, or not specified |