Red Hat Enterprise Linux 9.

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Flatpak: flatpak: arbitrary write in host context via flatpak build-init

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Path traversal

Flatpak: flatpak: arbitrary write access as root via extra-data extraction

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Emacs: emacs: arbitrary code execution in flymake mode

• GNU Emacs
• Red Hat Enterprise Linux 10
• Code injection

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-280

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Gcc: libstdc++ integer overflow in `new` operator

• Red Hat Enterprise Linux 8
• Red Hat Hardened Images
• Memory corruption

Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Cri-o: cri-o checkpoint restore bypasses destination security context

• Red Hat Confidential Compute Attestation
• Red Hat Enterprise Linux 8
• Privilege escalation

Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-61

Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-363

Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-363

Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-214

Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-214

Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-214

Cockpit: cockpit: unauthorized modification of login records via integer overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Denial of service

Cockpit: cockpit: denial of service via unbounded connection thread spawning

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Denial of service

Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service.

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Broken access control

Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-606

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config

• Red Hat
• Red Hat Build of Apache Camel 3.33.4.redhat
• CWE-346
• CWE-942

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

• Red Hat
• Red Hat Build of Apache Camel 3.33.4.redhat
• CWE-409

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Redis: redis: out-of-bounds read via crafted cluster bus packets

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Code injection

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Denial of service

Podman: arbitrary file write when importing oci archive

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-277

Gimp: integer overflow when generating a thumbnail preview for a psd file

• GNOME GIMP
• Red Hat Enterprise Linux 8
• Memory corruption

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Path traversal

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

• Red Hat Hardened Images
• Red Hat Ansible Automation Platform 2
• Path traversal

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Command injection

Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 9.6 Extended Update Support
• Privilege escalation

PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

• Fedora
• Red Hat Enterprise Linux 9
• Broken access control

Sssd: sssd: denial of service in nss responder via crafted zero-length requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: local denial of service due to null pointer dereference in pam responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via malformed pam v1 requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Device-mapper-multipath: local denial of service via blocking ipc send operations

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-1322

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

• Red Hat Hardened Images
• Red Hat Ceph Storage 4
• Memory corruption

Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-61

Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gvfs: gvfs-admin socket ownership race permits local root

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Race condition