# Red Hat Enterprise Linux 9. Every CVE that names Red Hat Enterprise Linux 9 among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm](https://agentprime.io/advisories/CVE-2026-95521.md) `CVE-2026-95521` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [Rpm: code execution via macro expansion of manifest entries in \`rpmgi\` (\`-q -p\` / verify manifest flows)](https://agentprime.io/advisories/CVE-2026-95519.md) `CVE-2026-95519` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file](https://agentprime.io/advisories/CVE-2026-97185.md) `CVE-2026-97185` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Memory corruption - [Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader](https://agentprime.io/advisories/CVE-2026-96546.md) `CVE-2026-96546` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 2.5 Low · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption - [Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader](https://agentprime.io/advisories/CVE-2026-96545.md) `CVE-2026-96545` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption - [Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline](https://agentprime.io/advisories/CVE-2026-96541.md) `CVE-2026-96541` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 2 more · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service - [Flatpak: flatpak: arbitrary write in host context via flatpak build-init](https://agentprime.io/advisories/CVE-2026-96276.md) `CVE-2026-96276` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Path traversal - [Flatpak: flatpak: arbitrary write access as root via extra-data extraction](https://agentprime.io/advisories/CVE-2026-96275.md) `CVE-2026-96275` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Path traversal - [Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization](https://agentprime.io/advisories/CVE-2026-96512.md) `CVE-2026-96512` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Emacs: emacs: arbitrary code execution in flymake mode](https://agentprime.io/advisories/CVE-2026-96442.md) `CVE-2026-96442` · CVE record: GNU Emacs GNU Emacs and 4 more · CVSS 7.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection - [Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization](https://agentprime.io/advisories/CVE-2026-90462.md) `CVE-2026-90462` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-280 - [Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service](https://agentprime.io/advisories/CVE-2026-94640.md) `CVE-2026-94640` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: Denial of service - [Gcc: libstdc++ integer overflow in \`new\` operator](https://agentprime.io/advisories/CVE-2026-95619.md) `CVE-2026-95619` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption - [Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu](https://agentprime.io/advisories/CVE-2026-95508.md) `CVE-2026-95508` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.4 High · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption - [Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing](https://agentprime.io/advisories/CVE-2026-93433.md) `CVE-2026-93433` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption - [Usbredir: usbredir: unbounded iso_packet_desc\[\] index in usbredirhost_iso_packet() leads to heap out-of-bounds write](https://agentprime.io/advisories/CVE-2026-92382.md) `CVE-2026-92382` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption - [Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)](https://agentprime.io/advisories/CVE-2026-94184.md) `CVE-2026-94184` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption - [Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint](https://agentprime.io/advisories/CVE-2026-80110.md) `CVE-2026-80110` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control - [Cri-o: cri-o checkpoint restore bypasses destination security context](https://agentprime.io/advisories/CVE-2026-92574.md) `CVE-2026-92574` · CVE record: Red Hat Confidential Compute Attestation and 4 more · CVSS 8.8 High · Not analysed yet · Published 21 Sept 2026 · Tags: Privilege escalation - [Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste](https://agentprime.io/advisories/CVE-2026-91202.md) `CVE-2026-91202` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-61 - [Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition](https://agentprime.io/advisories/CVE-2026-91203.md) `CVE-2026-91203` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-363 - [Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race](https://agentprime.io/advisories/CVE-2026-91205.md) `CVE-2026-91205` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 6.0 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-363 - [Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments](https://agentprime.io/advisories/CVE-2026-92768.md) `CVE-2026-92768` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-214 - [Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list](https://agentprime.io/advisories/CVE-2026-92747.md) `CVE-2026-92747` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 5.0 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-214 - [Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments](https://agentprime.io/advisories/CVE-2026-92745.md) `CVE-2026-92745` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 5.0 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-214 - [Cockpit: cockpit: unauthorized modification of login records via integer overflow](https://agentprime.io/advisories/CVE-2026-91142.md) `CVE-2026-91142` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 3.6 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption - [Cockpit: cockpit: denial of service in \`cockpit-ws\` due to url-root handling without a trailing slash](https://agentprime.io/advisories/CVE-2026-91147.md) `CVE-2026-91147` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Cockpit: cockpit: denial of service via unbounded connection thread spawning](https://agentprime.io/advisories/CVE-2026-91149.md) `CVE-2026-91149` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service - [Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service.](https://agentprime.io/advisories/CVE-2026-75883.md) `CVE-2026-75883` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption - [Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks](https://agentprime.io/advisories/CVE-2026-93676.md) `CVE-2026-93676` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 3.2 Low · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control - [Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)](https://agentprime.io/advisories/CVE-2026-93653.md) `CVE-2026-93653` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-606 - [Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram](https://agentprime.io/advisories/CVE-2026-81627.md) `CVE-2026-81627` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption - [Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config](https://agentprime.io/advisories/CVE-2026-89058.md) `CVE-2026-89058` · CVE record: Red Hat and 4 more · CVSS 7.4 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-346, CWE-942 - [Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)](https://agentprime.io/advisories/CVE-2026-89059.md) `CVE-2026-89059` · CVE record: Red Hat and 4 more · CVSS 7.5 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-409 - [Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute](https://agentprime.io/advisories/CVE-2026-76781.md) `CVE-2026-76781` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption - [Redis: redis: out-of-bounds read via crafted cluster bus packets](https://agentprime.io/advisories/CVE-2026-92925.md) `CVE-2026-92925` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption - [Flatpak-builder: host code execution via \`git am\` hook execution in patch source extraction (\`use-git-am\`)](https://agentprime.io/advisories/CVE-2026-86320.md) `CVE-2026-86320` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Code injection - [Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion](https://agentprime.io/advisories/CVE-2026-42784.md) `CVE-2026-42784` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 4 more · CVSS 7.4 High · Not analysed yet · Published 16 Sept 2026 · Tags: Weak cryptography or TLS - [Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array](https://agentprime.io/advisories/CVE-2026-92091.md) `CVE-2026-92091` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Denial of service - [Podman: arbitrary file write when importing oci archive](https://agentprime.io/advisories/CVE-2025-11395.md) `CVE-2025-11395` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-277 - [Gimp: integer overflow when generating a thumbnail preview for a psd file](https://agentprime.io/advisories/CVE-2026-92248.md) `CVE-2026-92248` · CVE record: GNOME GIMP and 4 more · CVSS 7.8 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption - [Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine](https://agentprime.io/advisories/CVE-2026-85234.md) `CVE-2026-85234` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption - [Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory](https://agentprime.io/advisories/CVE-2026-79699.md) `CVE-2026-79699` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal - [Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers](https://agentprime.io/advisories/CVE-2026-79705.md) `CVE-2026-79705` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 4.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal - [Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters](https://agentprime.io/advisories/CVE-2026-85013.md) `CVE-2026-85013` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection - [Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size](https://agentprime.io/advisories/CVE-2026-91786.md) `CVE-2026-91786` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 6.1 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption - [Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins](https://agentprime.io/advisories/CVE-2026-75092.md) `CVE-2026-75092` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 3 more · CVSS 7.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation - [PackageKit: dnf5 backend ignores SIMULATE on RepoRemove](https://agentprime.io/advisories/CVE-2026-19816.md) `CVE-2026-19816` · CVE record: Fedora Fedora and 4 more · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control - [Sssd: sssd: denial of service in nss responder via crafted zero-length requests](https://agentprime.io/advisories/CVE-2026-90996.md) `CVE-2026-90996` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.0 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption - [Sssd: sssd: local denial of service due to null pointer dereference in pam responder](https://agentprime.io/advisories/CVE-2026-90995.md) `CVE-2026-90995` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption - [Sssd: sssd: denial of service via malformed pam v1 requests](https://agentprime.io/advisories/CVE-2026-90994.md) `CVE-2026-90994` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.0 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption - [Sssd: local oob read in nss service request parsers (\`sss_nss_protocol_parse_svc_name\` / \`sss_nss_protocol_parse_svc_port\`)](https://agentprime.io/advisories/CVE-2026-90463.md) `CVE-2026-90463` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.0 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption - [Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file](https://agentprime.io/advisories/CVE-2026-90947.md) `CVE-2026-90947` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption - [Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch](https://agentprime.io/advisories/CVE-2026-90949.md) `CVE-2026-90949` · CVE record: Red Hat Red Hat Enterprise Linux 6 and 3 more · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption - [Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions](https://agentprime.io/advisories/CVE-2026-90948.md) `CVE-2026-90948` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption - [Device-mapper-multipath: local denial of service via blocking ipc send operations](https://agentprime.io/advisories/CVE-2026-89329.md) `CVE-2026-89329` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-1322 - [Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough](https://agentprime.io/advisories/CVE-2026-18495.md) `CVE-2026-18495` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Memory corruption - [Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink](https://agentprime.io/advisories/CVE-2026-77159.md) `CVE-2026-77159` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-61 - [Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser](https://agentprime.io/advisories/CVE-2026-88914.md) `CVE-2026-88914` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Memory corruption - [Gvfs: gvfs-admin socket ownership race permits local root](https://agentprime.io/advisories/CVE-2026-88924.md) `CVE-2026-88924` · CVE record: GNOME gvfs and 4 more · CVSS 7.0 High · Not analysed yet · Published 10 Sept 2026 · Tags: Race condition Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .