Red Hat Enterprise Linux 9.

Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• CWE-84

Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Broken access control

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

• containers crun
• Red Hat Hardened Images
• Path traversal

Crun: crun: rootful krun with passt executes container payload as host root

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Privilege escalation

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Cross-site scripting (XSS)

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-178

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-187

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler

• Red Hat Fast Datapath for RHEL 10
• Red Hat Fast Datapath for RHEL 8
• Memory corruption

Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libxml2: double-free/uaf in libxml2 python bindings

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gnome-tweaks: path traversal in theme installer

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Path traversal

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Command injection

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Authentication bypass

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Memory corruption

389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Memory corruption

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Broken access control

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Code injection

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Authentication bypass

Flatpak: flatpak: toctou race condition allows symlink redirection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Race condition

Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Denial of service

Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Memory corruption

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Memory corruption

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Memory corruption

Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal

• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 8
• Denial of service

Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Race condition

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• CWE-775

Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Open redirect

Gvfs: mtp: out-of-bounds read in do_read()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Gvfs: afp: heap-based buffer overflow in dsi read path

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Gvfs: sftp: uninitialized heap disclosure in read_string()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Gvfs: sftp: heap-based buffer overflow in read_reply()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts

• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10
• Information disclosure
• Broken access control

Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10
• Information disclosure

Popt-devel: popt-static: short realloc in poptconfigfiletostring

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

• WebKit
• WebKitGTK
• Memory corruption

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

• Red Hat Build of Apache Camel 3.33.3.SP1
• Red Hat build of Keycloak 26.6
• XML external entities (XXE)

Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 10
• Denial of service

Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-129

Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0

• GNOME GIMP
• Red Hat Enterprise Linux 6
• Memory corruption

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Denial of service