Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Red Hat Enterprise Linux 10 — Vulnerabilities & Security Advisories 361

All 361 CVE vulnerabilities found in Red Hat Enterprise Linux 10, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for Red Hat Enterprise Linux 10. It collects security advisories published by Red Hat covering this specific product version, spanning its entire support lifecycle. Readers can track the vendor's security responses, analyze specific weakness classes such as buffer overflows or privilege escalation, and review the product's complete vulnerability history.

Vendor: Red Hat

CVE ID Title CVSS Severity Published
CVE-2026-96281 Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes CWE-284 6.2 Medium 2026-09-27
CVE-2026-96280 Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems CWE-197 7.5 High 2026-09-27
CVE-2026-96279 Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks CWE-59 6.5 Medium 2026-09-27
CVE-2026-93834 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape CWE-416 8.8 High 2026-09-25
CVE-2026-95521 Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm CWE-78 7.8 High 2026-09-24
CVE-2026-95519 Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) CWE-78 7.8 High 2026-09-24
CVE-2026-96889 Librsvg: use-after-free when xml includes have duplicated entities CWE-416 7.8 High 2026-09-23
CVE-2026-96546 Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader CWE-125 2.5 Low 2026-09-23
CVE-2026-96545 Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader CWE-125 4.4 Medium 2026-09-23
CVE-2026-96541 Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline CWE-400 7.5 High 2026-09-23
CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init CWE-22 6.5 Medium 2026-09-23
CVE-2026-96275 Flatpak: flatpak: arbitrary write access as root via extra-data extraction CWE-22 8.8 High 2026-09-23
CVE-2026-96512 Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization CWE-863 7.8 High 2026-09-23
CVE-2026-90462 Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization CWE-280 5.4 Medium 2026-09-22
CVE-2026-94640 Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service CWE-400 7.5 High 2026-09-22
CVE-2026-95508 Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu CWE-787 7.4 High 2026-09-22
CVE-2026-93433 Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing CWE-121 5.5 Medium 2026-09-21
CVE-2026-92382 Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write CWE-787 4.1 Medium 2026-09-21
CVE-2026-94184 Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) CWE-121 5.3 Medium 2026-09-21
CVE-2026-80110 Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint CWE-863 8.1 High 2026-09-21
CVE-2026-91202 Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste CWE-61 6.1 Medium 2026-09-18
CVE-2026-91203 Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition CWE-363 6.0 Medium 2026-09-18
CVE-2026-91205 Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race CWE-363 6.0 Medium 2026-09-18
CVE-2026-92768 Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments CWE-214 5.5 Medium 2026-09-18
CVE-2026-92747 Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list CWE-214 5.0 Medium 2026-09-18
CVE-2026-92745 Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments CWE-214 5.0 Medium 2026-09-18
CVE-2026-91142 Cockpit: integer overflow in `do_lastlog()` offset calculation can misaddress `lastlog` entries on ilp32 builds CWE-787 3.6 Low 2026-09-18
CVE-2026-91147 Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash CWE-617 5.9 Medium 2026-09-18
CVE-2026-91149 Cockpit: cockpit: denial of service via unbounded connection thread spawning CWE-770 7.5 High 2026-09-18
CVE-2026-93676 Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks CWE-284 3.2 Low 2026-09-18

All 361 known CVE vulnerabilities affecting Red Hat Enterprise Linux 10 with full Chinese analysis, references, and POCs where available.