# Red Hat Enterprise Linux 9.6 Extended Update Support. Every CVE that names Red Hat Enterprise Linux 9.6 Extended Update Support among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns](https://agentprime.io/advisories/CVE-2026-114406.md) `CVE-2026-114406` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS - [Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth](https://agentprime.io/advisories/CVE-2026-102560.md) `CVE-2026-102560` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [Libsoup: libsoup: heap buffer overflow during websocket client-frame masking](https://agentprime.io/advisories/CVE-2026-102559.md) `CVE-2026-102559` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth](https://agentprime.io/advisories/CVE-2026-102558.md) `CVE-2026-102558` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [Libsoup: libsoup: heap buffer overflow during websocket message reassembly](https://agentprime.io/advisories/CVE-2026-102557.md) `CVE-2026-102557` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion](https://agentprime.io/advisories/CVE-2026-102556.md) `CVE-2026-102556` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc](https://agentprime.io/advisories/CVE-2026-97024.md) `CVE-2026-97024` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-61 - [Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin](https://agentprime.io/advisories/CVE-2026-97023.md) `CVE-2026-97023` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-61 - [Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems](https://agentprime.io/advisories/CVE-2026-96280.md) `CVE-2026-96280` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 27 Sept 2026 · Tags: CWE-197 - [Flatpak: flatpak: arbitrary write access as root via extra-data extraction](https://agentprime.io/advisories/CVE-2026-96275.md) `CVE-2026-96275` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Path traversal - [Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization](https://agentprime.io/advisories/CVE-2026-96512.md) `CVE-2026-96512` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint](https://agentprime.io/advisories/CVE-2026-80110.md) `CVE-2026-80110` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)](https://agentprime.io/advisories/CVE-2026-89059.md) `CVE-2026-89059` · CVE record: Red Hat and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-409 - [Redis: redis: out-of-bounds read via crafted cluster bus packets](https://agentprime.io/advisories/CVE-2026-92925.md) `CVE-2026-92925` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption - [Flatpak-builder: host code execution via \`git am\` hook execution in patch source extraction (\`use-git-am\`)](https://agentprime.io/advisories/CVE-2026-86320.md) `CVE-2026-86320` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Code injection - [Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins](https://agentprime.io/advisories/CVE-2026-75092.md) `CVE-2026-75092` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 3 more · CVSS 7.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [Gvfs: gvfs-admin socket ownership race permits local root](https://agentprime.io/advisories/CVE-2026-88924.md) `CVE-2026-88924` · CVE record: GNOME gvfs and 4 more · CVSS 7.0 High · Not analysed yet · Published 10 Sept 2026 · Tags: Race condition - [Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url](https://agentprime.io/advisories/CVE-2026-18147.md) `CVE-2026-18147` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.1 High · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS) - [Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup](https://agentprime.io/advisories/CVE-2026-87766.md) `CVE-2026-87766` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: Path traversal - [Libxml2: double-free/uaf in libxml2 python bindings](https://agentprime.io/advisories/CVE-2026-74860.md) `CVE-2026-74860` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption - [Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)](https://agentprime.io/advisories/CVE-2026-76561.md) `CVE-2026-76561` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Command injection - [389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property](https://agentprime.io/advisories/CVE-2026-18922.md) `CVE-2026-18922` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass - [389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search](https://agentprime.io/advisories/CVE-2026-18453.md) `CVE-2026-18453` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 7.5 High · Not analysed yet · Published 7 Sept 2026 · Tags: Memory corruption - [389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()](https://agentprime.io/advisories/CVE-2026-18355.md) `CVE-2026-18355` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 7.5 High · Not analysed yet · Published 7 Sept 2026 · Tags: Memory corruption - [389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn](https://agentprime.io/advisories/CVE-2026-76560.md) `CVE-2026-76560` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 7.5 High · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control - [Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service](https://agentprime.io/advisories/CVE-2026-79678.md) `CVE-2026-79678` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.1 High · Not analysed yet · Published 7 Sept 2026 · Tags: Code injection - [Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci](https://agentprime.io/advisories/CVE-2026-76578.md) `CVE-2026-76578` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass - [Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly](https://agentprime.io/advisories/CVE-2026-81665.md) `CVE-2026-81665` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Memory corruption - [Gvfs: sftp: heap-based buffer overflow in read_reply()](https://agentprime.io/advisories/CVE-2026-84268.md) `CVE-2026-84268` · CVE record: GNOME gvfs and 4 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption - [Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature](https://agentprime.io/advisories/CVE-2026-83596.md) `CVE-2026-83596` · CVE record: WebKit WebKit and 4 more · CVSS 8.8 High · Not analysed yet · Published 31 Aug 2026 · Tags: Memory corruption - [Resteasy-core: resteasy sourceprovider remote unauthenticated file read](https://agentprime.io/advisories/CVE-2026-17615.md) `CVE-2026-17615` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP1 and 4 more · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: XML external entities (XXE) - [Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function](https://agentprime.io/advisories/CVE-2026-78002.md) `CVE-2026-78002` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 27 Aug 2026 · Tags: Memory corruption - [Webkitgtk: use-after-free of jscvalue function parameters](https://agentprime.io/advisories/CVE-2026-78376.md) `CVE-2026-78376` · CVE record: WebKit WebKit and 4 more · CVSS 8.8 High · Not analysed yet · Published 24 Aug 2026 · Tags: Memory corruption - [Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships](https://agentprime.io/advisories/CVE-2026-11861.md) `CVE-2026-11861` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Privilege escalation - [Ipa: freeipa: unauthenticated dos in \`/ipa/i18n_messages\` via unbounded request body read](https://agentprime.io/advisories/CVE-2026-73198.md) `CVE-2026-73198` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore](https://agentprime.io/advisories/CVE-2026-13097.md) `CVE-2026-13097` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-706 - [Ipa: freeipa: unauthenticated dos in \`/ipa/migration/migration.py\` via unbounded request body read](https://agentprime.io/advisories/CVE-2026-73197.md) `CVE-2026-73197` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Denial of service - [Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow](https://agentprime.io/advisories/CVE-2026-18917.md) `CVE-2026-18917` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: Memory corruption - [Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd](https://agentprime.io/advisories/CVE-2026-19654.md) `CVE-2026-19654` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: Memory corruption - [Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write](https://agentprime.io/advisories/CVE-2026-73433.md) `CVE-2026-73433` · CVE record: GStreamer gst-plugins-good and 4 more · CVSS 6.6 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Memory corruption - [Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing](https://agentprime.io/advisories/CVE-2026-73434.md) `CVE-2026-73434` · CVE record: GStreamer gst-plugins-good and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Memory corruption - [Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes](https://agentprime.io/advisories/CVE-2026-19550.md) `CVE-2026-19550` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.2 High · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control - [Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation](https://agentprime.io/advisories/CVE-2026-72694.md) `CVE-2026-72694` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 11 Aug 2026 · Tags: Path traversal - [Libvirt: swtpm privilege escalation via symlink following](https://agentprime.io/advisories/CVE-2026-63622.md) `CVE-2026-63622` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 Aug 2026 · Tags: Path traversal - [Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow](https://agentprime.io/advisories/CVE-2026-59090.md) `CVE-2026-59090` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 8.4 High · Not analysed yet · Published 10 Aug 2026 · Tags: Memory corruption - [Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read](https://agentprime.io/advisories/CVE-2026-19389.md) `CVE-2026-19389` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 10 Aug 2026 · Tags: Memory corruption - [Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder](https://agentprime.io/advisories/CVE-2026-19387.md) `CVE-2026-19387` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.6 High · Not analysed yet · Published 10 Aug 2026 · Tags: Memory corruption - [Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()](https://agentprime.io/advisories/CVE-2026-15816.md) `CVE-2026-15816` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2026 · Tags: Command injection - [Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders](https://agentprime.io/advisories/CVE-2026-18649.md) `CVE-2026-18649` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Denial of service - [Libkcapi: infinite loop denial of service in libkcapi \_kcapi_aio_read_all() due to unhandled io_getevents() timeout return](https://agentprime.io/advisories/CVE-2026-71227.md) `CVE-2026-71227` · CVE record: Stephan Muelle libkcapi and 4 more · CVSS 5.1 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Denial of service - [Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path](https://agentprime.io/advisories/CVE-2026-71226.md) `CVE-2026-71226` · CVE record: Stephan Muelle libkcapi and 4 more · CVSS 7.3 High · Not analysed yet · Published 5 Aug 2026 · Tags: Memory corruption - [Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries](https://agentprime.io/advisories/CVE-2026-71225.md) `CVE-2026-71225` · CVE record: Stephan Muelle libkcapi and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Weak cryptography or TLS - [Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)](https://agentprime.io/advisories/CVE-2026-42169.md) `CVE-2026-42169` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 7.3 High · Not analysed yet · Published 4 Aug 2026 · Tags: Memory corruption - [389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check](https://agentprime.io/advisories/CVE-2026-11770.md) `CVE-2026-11770` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Other injection - [389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing](https://agentprime.io/advisories/CVE-2026-15722.md) `CVE-2026-15722` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Memory corruption - [Pcp: pcp: denial of service due to signed integer overflow](https://agentprime.io/advisories/CVE-2026-16529.md) `CVE-2026-16529` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Memory corruption - [Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules](https://agentprime.io/advisories/CVE-2026-16527.md) `CVE-2026-16527` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.3 High · Not analysed yet · Published 30 Jul 2026 · Tags: Broken access control, Authentication bypass - [Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability](https://agentprime.io/advisories/CVE-2026-16526.md) `CVE-2026-16526` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-403 - [Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection](https://agentprime.io/advisories/CVE-2026-16524.md) `CVE-2026-16524` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 30 Jul 2026 · Tags: Command injection - [Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export](https://agentprime.io/advisories/CVE-2026-16313.md) `CVE-2026-16313` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.6 High · Not analysed yet · Published 28 Jul 2026 · Tags: Other injection Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .