Red Hat vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-92171 New	RH Red Hat Data Grid 8 Red Hat	6.5	0%	Oct 26	Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
CVE-2026-116497 New	RH Red Hat Enterprise Linux 7 Red Hat	5.5	0%	Oct 26	Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon
CVE-2026-115486 New	RH Red Hat Enterprise Linux 10 Red Hat	7.1	0%	Oct 23	Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
CVE-2026-115485 New	RH Red Hat Enterprise Linux 9 Red Hat	6.3	0%	Oct 23	Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
CVE-2026-115484 New	RH Red Hat Enterprise Linux 9 Red Hat	7.6	0%	Oct 23	Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
CVE-2026-115449 New	RH Red Hat Enterprise Linux 8 Red Hat	3.5	0%	Oct 22	Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
CVE-2026-115221 New	RH Red Hat Enterprise Linux 8 Red Hat	5.4	0%	Oct 22	Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership
CVE-2026-115424 New	RH Red Hat OpenShift Container Platform 4 Red Hat	5.5	0%	Oct 22	Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination
CVE-2026-111079 New	RH Red Hat Enterprise Linux 10 Red Hat	7.4	0%	Oct 22	Goose: goose: shell history and environment leak via terminal integration
CVE-2026-115207 New	RH Red Hat Enterprise Linux 9 Red Hat	5.5	0%	Oct 22	Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
CVE-2026-114406 New	RH Red Hat OpenShift Builds 1.9.2 Red Hat	6.8	0%	Oct 21	Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
CVE-2026-85518 New	RH Red Hat Enterprise Linux 9 Red Hat	6.1	0%	Oct 21	Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition
CVE-2026-114438 New	RH Red Hat Build of Keycloak Red Hat	4.2	0%	Oct 21	Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering
CVE-2026-110744 New	MG Multicluster Global Hub Red Hat	7.2	0%	Oct 21	Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide
CVE-2026-114370 New	RH Red Hat Single Sign-On 7 Red Hat	3.7	0%	Oct 21	Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal
CVE-2026-114236	RH Red Hat Hardened Images Red Hat	3.3	0%	Oct 21	Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
CVE-2026-17557	RH Red Hat OpenShift AI (RHOAI) Red Hat	6.5	0%	Oct 21	Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
CVE-2026-92824	RH Red Hat OpenShift Container Platform 4 Red Hat	6.2	0%	Oct 21	Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
CVE-2026-92822	RH Red Hat OpenShift Container Platform 4 Red Hat	6.2	0%	Oct 21	Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
CVE-2026-92823	RH Red Hat Enterprise Linux 8 Red Hat	6.2	0%	Oct 21	Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
CVE-2026-114038	RH Red Hat Enterprise Linux 9 Red Hat	5.1	0%	Oct 21	Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string
CVE-2026-105941	SF streams for Apache Kafka 3 Red Hat	8.1	0%	Oct 20	Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
CVE-2026-105949	SF streams for Apache Kafka 2 Red Hat	8.8	0%	Oct 20	Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
CVE-2026-105312	SF streams for Apache Kafka 3 Red Hat	9.9	0%	Oct 20	Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
CVE-2026-105311	SF streams for Apache Kafka 2 Red Hat	7.7	0%	Oct 20	Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
CVE-2026-113496	RH Red Hat Enterprise Linux 10 Red Hat	5.0	0%	Oct 20	Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
CVE-2026-113495	RH Red Hat Enterprise Linux 9 Red Hat	5.0	0%	Oct 20	Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
CVE-2026-112177	RH Red Hat Enterprise Linux 8 Red Hat	7.3	0%	Oct 20	Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
CVE-2026-112261	RH Red Hat Enterprise Linux 9 Red Hat	7.8	0%	Oct 19	Gimp: gimp: use-after-free in xcf loader via prop_selected_path
CVE-2026-112258	RH Red Hat Enterprise Linux 9 Red Hat	7.8	0%	Oct 19	Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
CVE-2026-112257	RH Red Hat Enterprise Linux 10 Red Hat	7.8	0%	Oct 19	Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
CVE-2026-112260	RH Red Hat Enterprise Linux 9 Red Hat	7.1	0%	Oct 19	Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
CVE-2026-112259	RH Red Hat Enterprise Linux 9 Red Hat	5.5	0%	Oct 19	Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
CVE-2026-112214	RH Red Hat Enterprise Linux 10 Red Hat	6.5	0%	Oct 19	Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
CVE-2026-103314	RH Red Hat Advanced Cluster Security for Kubernetes 4.11 Red Hat	7.4	0%	Oct 19	Stackrox: stackrox: saml response replay allows multiple central authentication tokens
CVE-2026-112210	RH Red Hat Enterprise Linux 10 Red Hat	6.0	0%	Oct 19	Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
CVE-2026-16460	RH Red Hat Hardened Images Red Hat	7.4	0%	Oct 19	Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
CVE-2026-89096	RH Red Hat Enterprise Linux 7 Red Hat	5.9	0%	Oct 16	Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
CVE-2026-89088	RH Red Hat Enterprise Linux 10 Red Hat	5.5	0%	Oct 16	Parted: parted: denial of service via heap buffer overflow during fat16 resize
CVE-2026-89085	RH Red Hat Enterprise Linux 6 Red Hat	6.6	0%	Oct 16	Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image
CVE-2026-111802	RH Red Hat Enterprise Linux 7 Red Hat	6.6	0%	Oct 16	Nautilus: nautilus: arbitrary file deletion via trash symlink
CVE-2026-17591	RH Red Hat Enterprise Linux 6 Red Hat	3.6	0%	Oct 16	Libarchive: libarchive: use-after-free via aliased mac metadata copy
CVE-2026-62438	RH Red Hat Enterprise Linux 10 Red Hat	6.1	0%	Oct 16	Gimp: gimp: paa integer overflow out-of-bounds read
CVE-2026-62439	RH Red Hat Enterprise Linux 6 Red Hat	7.0	0%	Oct 16	Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
CVE-2026-85977	RH Red Hat OpenShift Container Platform 4 Red Hat	5.3	0%	Oct 16	Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding
CVE-2026-85231	RH Red Hat Enterprise Linux 6 Red Hat	6.5	0%	Oct 16	Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
CVE-2026-89098	RH Red Hat Enterprise Linux 6 Red Hat	5.5	0%	Oct 16	Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd
CVE-2026-111581	RH Red Hat Enterprise Linux 9 Red Hat	3.3	0%	Oct 16	Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method
CVE-2026-111555	RH Red Hat Enterprise Linux 9 Red Hat	6.0	0%	Oct 16	Luksmeta: missing slot-range validation permits out-of-gap device i/o
CVE-2026-105958	RH Red Hat Enterprise Linux 8 Red Hat	7.5	0%	Oct 16	Spice-server: spice: heap oob read/write via unchecked migration data offsets
CVE-2026-105959	RH Red Hat Enterprise Linux 8 Red Hat	7.5	0%	Oct 16	Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
CVE-2026-104715	RH Red Hat Enterprise Linux 6 Red Hat	7.8	0%	Oct 16	Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
CVE-2026-84823	RH Red Hat JBoss Enterprise Application Platform 8 Red Hat	7.1	0%	Oct 15	Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role
CVE-2026-109131	RH Red Hat Ansible Automation Platform 2 Red Hat	5.4	0%	Oct 15	Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)
CVE-2026-108334	RH Red Hat Connectivity Link 1.4 Red Hat	7.4	0%	Oct 15	Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
CVE-2026-85634	RH Red Hat JBoss Enterprise Application Platform 8 Red Hat	8.8	0%	Oct 15	Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name
CVE-2026-92982	RH Red Hat OpenStack Platform 18.0 Red Hat	8.5	0%	Oct 15	Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
CVE-2026-110777	RH Red Hat Enterprise Linux 8 Red Hat	5.7	0%	Oct 14	Evolution-data-server: local file disclosure via attach file:// uris
CVE-2026-86849	RH Red Hat OpenStack Platform 13 (Queens) Red Hat	6.5	0%	Oct 14	Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto
CVE-2026-86856	RH Red Hat OpenStack Platform 13 (Queens) Red Hat	6.5	0%	Oct 14	Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver