Red Hat Enterprise Linux 6.

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Emacs: emacs: arbitrary code execution in flymake mode

• GNU Emacs
• Red Hat Enterprise Linux 10
• Code injection

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-280

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Gcc: libstdc++ integer overflow in `new` operator

• Red Hat Enterprise Linux 8
• Red Hat Hardened Images
• Memory corruption

Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service.

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-606

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: integer overflow when generating a thumbnail preview for a psd file

• GNOME GIMP
• Red Hat Enterprise Linux 8
• Memory corruption

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Command injection

PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

• Fedora
• Red Hat Enterprise Linux 9
• Broken access control

Sssd: sssd: denial of service in nss responder via crafted zero-length requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: local denial of service due to null pointer dereference in pam responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via malformed pam v1 requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Device-mapper-multipath: local denial of service via blocking ipc send operations

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-1322

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

• Red Hat Hardened Images
• Red Hat Ceph Storage 4
• Memory corruption

Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-61

Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gvfs: gvfs-admin socket ownership race permits local root

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Race condition

Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• CWE-84

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Cross-site scripting (XSS)

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-178

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-187

Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Command injection

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Code injection

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Authentication bypass

Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Open redirect

Gvfs: mtp: out-of-bounds read in do_read()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Gvfs: afp: heap-based buffer overflow in dsi read path

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Gvfs: sftp: uninitialized heap disclosure in read_string()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Gvfs: sftp: heap-based buffer overflow in read_reply()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts

• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10
• Information disclosure
• Broken access control

Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10
• Information disclosure

Popt-devel: popt-static: short realloc in poptconfigfiletostring

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

• WebKit
• WebKitGTK
• Memory corruption

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption