Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Red Hat — Vulnerabilities & Security Advisories 1444

Browse all 1444 CVE security advisories affecting Red Hat. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Red Hat operates primarily as a provider of open-source enterprise software solutions, most notably its Linux operating system and container platforms. With 688 recorded Common Vulnerabilities and Exposures, the organization’s historical attack surface frequently involves remote code execution, cross-site scripting, and privilege escalation flaws within its middleware and management tools. These vulnerabilities often stem from complex codebases and third-party dependencies integrated into its distribution. Security characteristics are defined by a rigorous patching lifecycle and the Red Hat Security Response Team, which issues timely advisories for critical issues. While major public breaches directly attributed to Red Hat core infrastructure are rare, individual component flaws have occasionally allowed attackers to gain unauthorized access or execute arbitrary commands. The company maintains a strong reputation for transparency, providing detailed technical guidance to help administrators mitigate risks associated with its widely deployed enterprise technologies.

CVE ID Title CVSS Severity Published
CVE-2026-14615 Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter — Red Hat build of Keycloak 26.4 CWE-1220 4.3 Medium 2026-07-03
CVE-2026-14614 Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource — Red Hat build of Keycloak 26.4 CWE-639 5.4 Medium 2026-07-03
CVE-2026-14613 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission — Red Hat build of Keycloak 26.6 CWE-1220 4.3 Medium 2026-07-03
CVE-2026-14612 Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization — Red Hat Enterprise Linux 10 CWE-787 4.2 Medium 2026-07-03
CVE-2026-58381 Gimp: gimp: double-free in read_layer_block() — Red Hat Enterprise Linux 6 CWE-415 6.1 Medium 2026-07-02
CVE-2026-14330 Pipewire: pulse server alloca stack overflow — Red Hat Enterprise Linux 9 CWE-770 5.5 Medium 2026-07-01
CVE-2026-14324 Pipewire: raop rtsp null deref — Red Hat Enterprise Linux 10 CWE-476 6.5 Medium 2026-07-01
CVE-2026-5138 Foreman: foreman: information disclosure via improper validation of nested request parameters — Red Hat Satellite 6.16 for RHEL 8 CWE-639 4.3 Medium 2026-07-01
CVE-2026-5135 Foreman: foreman: unauthorized modification of host configurations via broken access control — Red Hat Satellite 6.16 for RHEL 8 CWE-639 6.5 Medium 2026-07-01
CVE-2026-5142 Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass — Red Hat Satellite 6.16 for RHEL 8 CWE-639 6.5 Medium 2026-07-01
CVE-2026-5136 Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation — Red Hat Satellite 6.16 for RHEL 8 CWE-266 8.8 High 2026-07-01
CVE-2026-14258 Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling — Red Hat Enterprise Linux 10 CWE-835 6.5 Medium 2026-07-01
CVE-2026-4629 Keycloak: keycloak: privilege escalation through hardcoded role mapper injection — Red Hat build of Keycloak 26.4 CWE-266 6.5 Medium 2026-06-30
CVE-2026-12388 Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper — Red Hat Build of Keycloak CWE-266 6.5 Medium 2026-06-30
CVE-2026-14209 Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions — Red Hat build of Keycloak 26.4 CWE-639 4.3 Medium 2026-06-30
CVE-2026-13316 Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config — Red Hat Satellite 6 CWE-918 4.4 Medium 2026-06-30
CVE-2026-12610 Sssd: use-after-free crash in sssd' 'sssd_pam' process — Red Hat Enterprise Linux 10 CWE-825 6.4 Medium 2026-06-30
CVE-2026-14164 Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack() — Red Hat Enterprise Linux 10 CWE-415 7.5 High 2026-06-30
CVE-2026-13757 P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing — Red Hat Enterprise Linux 10 CWE-674 6.2 Medium 2026-06-29
CVE-2026-12912 Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image — Red Hat Enterprise Linux 10 CWE-122 7.3 High 2026-06-29
CVE-2026-12856 Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension — Red Hat OpenShift Dev Spaces 3.29 CWE-88 8.8 High 2026-06-29
CVE-2026-13601 Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications — Red Hat Enterprise Linux 7 Extended Lifecycle Support CWE-693 7.1 High 2026-06-29
CVE-2026-13595 Util-linux: util-linux: heap use-after-free in libblkid nested partition probing — Red Hat Hardened Images CWE-416 6.8 Medium 2026-06-29
CVE-2026-57966 Spice-vdagent: path traversal in file transfer via unsanitized filename — Red Hat Enterprise Linux 10 CWE-22 4.4 Medium 2026-06-29
CVE-2026-57965 Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow — Red Hat Enterprise Linux 10 CWE-190 5.1 Medium 2026-06-29
CVE-2026-13434 Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled — Red Hat OpenShift Virtualization 4 CWE-20 4.9 Medium 2026-06-26
CVE-2026-13322 Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service — Red Hat OpenShift Virtualization 4 CWE-770 3.8 Low 2026-06-26
CVE-2026-13083 Pen-drive: pen-drive: stored xss via unescaped cluster data in html report — Pen Drive Powered by Red Hat Lightspeed CWE-79 6.9 Medium 2026-06-25
CVE-2026-13318 Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip — Red Hat OpenShift Virtualization 4 CWE-918 6.4 Medium 2026-06-25
CVE-2026-13218 Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher — Red Hat OpenShift Virtualization 4 CWE-61 4.2 Medium 2026-06-25

This page lists every published CVE security advisory associated with Red Hat. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.