Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

RED HAT — Vulnerabilities & Security Advisories 1138

Browse all 1138 CVE security advisories affecting RED HAT. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Red Hat operates primarily as a provider of open-source enterprise software solutions, most notably its Linux operating system and container platforms. With 688 recorded Common Vulnerabilities and Exposures, the organization’s historical attack surface frequently involves remote code execution, cross-site scripting, and privilege escalation flaws within its middleware and management tools. These vulnerabilities often stem from complex codebases and third-party dependencies integrated into its distribution. Security characteristics are defined by a rigorous patching lifecycle and the Red Hat Security Response Team, which issues timely advisories for critical issues. While major public breaches directly attributed to Red Hat core infrastructure are rare, individual component flaws have occasionally allowed attackers to gain unauthorized access or execute arbitrary commands. The company maintains a strong reputation for transparency, providing detailed technical guidance to help administrators mitigate risks associated with its widely deployed enterprise technologies.

CVE IDTitleCVSSSeverityPublished
CVE-2026-74247 Quay: ssrf via build archive_url in quay build api — Red Hat OpenShift Update ServiceCWE-918 4.2 Medium2026-08-14
CVE-2026-74245 Quay: unauthenticated exported logs download in quay — Red Hat OpenShift Update ServiceCWE-306 5.9 Medium2026-08-14
CVE-2026-74243 Quay: unauthenticated secscan notification endpoint in quay when psk is unset — Red Hat OpenShift Update ServiceCWE-306 6.5 Medium2026-08-14
CVE-2026-74244 Quay: stripe webhook accepts forged events without signature verification in quay — Red Hat OpenShift Update ServiceCWE-347 5.9 Medium2026-08-14
CVE-2026-74242 Quay: repository notification uuid idor in quay api — Red Hat OpenShift Update ServiceCWE-639 5.3 Medium2026-08-14
CVE-2026-74241 Quay: ldap referral filter injection in quay external ldap authentication — Red Hat OpenShift Update ServiceCWE-90 4.8 Medium2026-08-14
CVE-2026-74240 Quay: jwt claim validation bypasses in quay federated robot and sso authentication — Red Hat OpenShift Update ServiceCWE-287 5.4 Medium2026-08-14
CVE-2026-13002 Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing — Red Hat Enterprise Linux 10CWE-835 4.4 Medium2026-08-14
CVE-2026-19879 Io.undertow/undertow: undertow: http response header integrity issue due to character truncation — Red Hat build of Apache Camel for Spring Boot 4CWE-681 5.3 Medium2026-08-14
CVE-2026-58224 Samba: ctdb fails to do integrity checking of received packets — Red Hat Enterprise Linux 10CWE-353 6.5 Medium2026-08-14
CVE-2026-19617 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser — Red Hat Enterprise Linux 10CWE-770 5.5 Medium2026-08-14
CVE-2026-19730 Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives — Red Hat Ansible Automation Platform 2CWE-459 4.2 Medium2026-08-13
CVE-2026-73266 Clusterclaims-controller: clusterclaims-controller: tenant-controlled clusterclaim labels propagated to managedcluster enabling cross-tenant managedclusterset join — Multicluster Engine for KubernetesCWE-441 7.1 High2026-08-13
CVE-2026-73584 Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling — Red Hat Enterprise Linux 10CWE-377 6.3 Medium2026-08-13
CVE-2026-73583 Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr — Red Hat Enterprise Linux 10CWE-125 6.6 Medium2026-08-13
CVE-2026-73585 Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack — Red Hat Enterprise Linux 10CWE-377 6.3 Medium2026-08-13
CVE-2026-18728 Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing — Red Hat Enterprise Linux 10CWE-191 6.5 Medium2026-08-13
CVE-2026-71846 Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege — Red Hat Advanced Cluster Management for Kubernetes 2CWE-250 6.5 Medium2026-08-12
CVE-2026-71469 Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos — Red Hat Advanced Cluster Management for Kubernetes 2CWE-770 7.5 High2026-08-12
CVE-2026-71471 Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image — Red Hat Advanced Cluster Management for Kubernetes 2CWE-829 9.0 Critical2026-08-12
CVE-2026-71473 Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke — Red Hat Advanced Cluster Management for Kubernetes 2CWE-915 8.5 High2026-08-12
CVE-2026-18727 Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing — Red Hat Enterprise Linux 10CWE-191 6.5 Medium2026-08-12
CVE-2026-18726 Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing — Red Hat Enterprise Linux 10CWE-835 6.5 Medium2026-08-12
CVE-2026-19654 Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd — Red Hat Enterprise Linux 10CWE-125 7.5 High2026-08-12
CVE-2026-19130 Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization — Multicluster Engine for KubernetesCWE-639 5.8 Medium2026-08-12
CVE-2026-13622 Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host — Red Hat Container Native Virtualization 4.12CWE-22 8.8 High2026-08-12
CVE-2026-72508 Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*) — Red Hat Advanced Cluster Management for Kubernetes 2CWE-250 9.9 Critical2026-08-12
CVE-2026-73268 Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection — Multicluster Engine for KubernetesCWE-94 9.9 Critical2026-08-12
CVE-2026-73269 Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa — Multicluster Engine for KubernetesCWE-269 9.9 Critical2026-08-12
CVE-2026-19548 Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing — Red Hat Enterprise Linux 10CWE-416 5.5 Medium2026-08-12

This page lists every published CVE security advisory associated with RED HAT. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.