Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Red Hat — Vulnerabilities & Security Advisories 1426

Browse all 1426 CVE security advisories affecting Red Hat. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Red Hat operates primarily as a provider of open-source enterprise software solutions, most notably its Linux operating system and container platforms. With 688 recorded Common Vulnerabilities and Exposures, the organization’s historical attack surface frequently involves remote code execution, cross-site scripting, and privilege escalation flaws within its middleware and management tools. These vulnerabilities often stem from complex codebases and third-party dependencies integrated into its distribution. Security characteristics are defined by a rigorous patching lifecycle and the Red Hat Security Response Team, which issues timely advisories for critical issues. While major public breaches directly attributed to Red Hat core infrastructure are rare, individual component flaws have occasionally allowed attackers to gain unauthorized access or execute arbitrary commands. The company maintains a strong reputation for transparency, providing detailed technical guidance to help administrators mitigate risks associated with its widely deployed enterprise technologies.

CVE ID Title CVSS Severity Published
CVE-2026-74242 Quay: repository notification uuid idor in quay api — Red Hat OpenShift Update Service CWE-639 5.3 Medium 2026-08-14
CVE-2026-74241 Quay: ldap referral filter injection in quay external ldap authentication — Red Hat OpenShift Update Service CWE-90 4.8 Medium 2026-08-14
CVE-2026-74240 Quay: jwt claim validation bypasses in quay federated robot and sso authentication — Red Hat OpenShift Update Service CWE-287 5.4 Medium 2026-08-14
CVE-2026-13002 Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing — Red Hat Enterprise Linux 10 CWE-835 4.4 Medium 2026-08-14
CVE-2026-19879 Io.undertow/undertow: undertow: http response header integrity issue due to character truncation — Red Hat build of Apache Camel for Spring Boot 4 CWE-681 5.3 Medium 2026-08-14
CVE-2026-58224 Samba: ctdb fails to do integrity checking of received packets — Red Hat Enterprise Linux 10 CWE-353 6.5 Medium 2026-08-14
CVE-2026-19617 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser — Red Hat Enterprise Linux 10 CWE-770 5.5 Medium 2026-08-14
CVE-2026-19730 Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives — Red Hat Enterprise Linux 10 CWE-459 4.2 Medium 2026-08-13
CVE-2026-73266 Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join — multicluster engine for Kubernetes 2.10 CWE-441 7.1 High 2026-08-13
CVE-2026-73584 Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling — Red Hat Enterprise Linux 10 CWE-377 6.3 Medium 2026-08-13
CVE-2026-73583 Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr — Red Hat Enterprise Linux 10 CWE-125 6.6 Medium 2026-08-13
CVE-2026-73585 Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack — Red Hat Enterprise Linux 10 CWE-377 6.3 Medium 2026-08-13
CVE-2026-18728 Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing — Red Hat Enterprise Linux 10 CWE-191 6.5 Medium 2026-08-13
CVE-2026-71846 Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege — Red Hat Advanced Cluster Management for Kubernetes 2.11 CWE-250 6.5 Medium 2026-08-12
CVE-2026-71469 Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos — Red Hat Advanced Cluster Management for Kubernetes 2.11 CWE-770 7.5 High 2026-08-12
CVE-2026-71471 Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image — Red Hat Advanced Cluster Management for Kubernetes 2.11 CWE-829 9.0 Critical 2026-08-12
CVE-2026-71473 Acm-search-v2-rhel9: search-v2-operator: addonfactory.getvaluesfromaddonannotation enables arbitrary helm-values override per spoke — Red Hat Advanced Cluster Management for Kubernetes 2.11 CWE-915 8.5 High 2026-08-12
CVE-2026-18727 Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing — Red Hat Enterprise Linux 10 CWE-191 6.5 Medium 2026-08-12
CVE-2026-18726 Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing — Red Hat Enterprise Linux 10 CWE-835 6.5 Medium 2026-08-12
CVE-2026-19654 Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd — Red Hat Enterprise Linux 10 CWE-125 7.5 High 2026-08-12
CVE-2026-19130 Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization — multicluster engine for Kubernetes 2.10 CWE-639 5.8 Medium 2026-08-12
CVE-2026-13622 Kubevirt: virt-handler-rhel9: kubevirt: virt-handler migration proxy follows symlinks allowing container escape to host — Red Hat Container Native Virtualization 4.12 CWE-22 8.8 High 2026-08-12
CVE-2026-72508 Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*) — Red Hat Advanced Cluster Management for Kubernetes 2.11 CWE-250 9.9 Critical 2026-08-12
CVE-2026-73268 Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection — multicluster engine for Kubernetes 2.10 CWE-94 9.9 Critical 2026-08-12
CVE-2026-73269 Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa — multicluster engine for Kubernetes 2.10 CWE-269 9.9 Critical 2026-08-12
CVE-2026-19548 Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing — Red Hat Enterprise Linux 10 CWE-416 5.5 Medium 2026-08-12
CVE-2026-18663 389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control — Red Hat Directory Server 11 CWE-415 5.9 Medium 2026-08-12
CVE-2026-64927 Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy — Red Hat Advanced Cluster Management for Kubernetes 2.11 CWE-639 6.4 Medium 2026-08-12
CVE-2026-73122 Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces — Red Hat Advanced Cluster Management for Kubernetes 2.11 CWE-269 7.7 High 2026-08-12
CVE-2026-66878 Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration — Red Hat Advanced Cluster Management for Kubernetes 2.11 CWE-639 7.7 High 2026-08-12

This page lists every published CVE security advisory associated with Red Hat. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.