# Red Hat Hardened Images. Every CVE that names Red Hat Hardened Images among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction](https://agentprime.io/advisories/CVE-2026-111253.md) `CVE-2026-111253` · CVE record: Red Hat Red Hat Hardened Images · CVSS 6.6 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail](https://agentprime.io/advisories/CVE-2026-123151.md) `CVE-2026-123151` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption - [Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch](https://agentprime.io/advisories/CVE-2026-121997.md) `CVE-2026-121997` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption - [Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length](https://agentprime.io/advisories/CVE-2026-121996.md) `CVE-2026-121996` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption - [Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail](https://agentprime.io/advisories/CVE-2026-121995.md) `CVE-2026-121995` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption - [Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length](https://agentprime.io/advisories/CVE-2026-121994.md) `CVE-2026-121994` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption - [Gcc: out-of-bounds read in std::from_chars](https://agentprime.io/advisories/CVE-2026-115456.md) `CVE-2026-115456` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 3.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption - [Gcc: stack overflow in std::bitset on libstdc++](https://agentprime.io/advisories/CVE-2026-115455.md) `CVE-2026-115455` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption - [Gcc: integer wrap in \`std](https://agentprime.io/advisories/CVE-2026-114691.md) `CVE-2026-114691` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption - [Gcc: confirmed out-of-bounds read/write in libstdc++ parallel \`std](https://agentprime.io/advisories/CVE-2026-114690.md) `CVE-2026-114690` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption - [Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow](https://agentprime.io/advisories/CVE-2026-85498.md) `CVE-2026-85498` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 3.5 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Memory corruption - [Patch: filename validation bypass in reversal fallback allows file creation outside the working directory](https://agentprime.io/advisories/CVE-2026-115207.md) `CVE-2026-115207` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal - [Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition](https://agentprime.io/advisories/CVE-2026-85518.md) `CVE-2026-85518` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal - [Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers](https://agentprime.io/advisories/CVE-2026-114236.md) `CVE-2026-114236` · CVE record: Red Hat Confidential Compute Attestation and 4 more · CVSS 3.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts](https://agentprime.io/advisories/CVE-2026-92824.md) `CVE-2026-92824` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption - [Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml](https://agentprime.io/advisories/CVE-2026-92822.md) `CVE-2026-92822` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service - [Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml](https://agentprime.io/advisories/CVE-2026-92823.md) `CVE-2026-92823` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-409 - [Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization](https://agentprime.io/advisories/CVE-2026-16460.md) `CVE-2026-16460` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.4 High · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-345 - [Libarchive: libarchive: use-after-free via aliased mac metadata copy](https://agentprime.io/advisories/CVE-2026-17591.md) `CVE-2026-17591` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 3.6 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption - [Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding](https://agentprime.io/advisories/CVE-2026-85977.md) `CVE-2026-85977` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-1050 - [Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding](https://agentprime.io/advisories/CVE-2026-85231.md) `CVE-2026-85231` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service - [Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption](https://agentprime.io/advisories/CVE-2026-88842.md) `CVE-2026-88842` · CVE record: Red Hat Red Hat Hardened Images · CVSS 3.3 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption - [Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy](https://agentprime.io/advisories/CVE-2026-88829.md) `CVE-2026-88829` · CVE record: Red Hat Red Hat Hardened Images · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: HTTP request smuggling - [Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush](https://agentprime.io/advisories/CVE-2026-90954.md) `CVE-2026-90954` · CVE record: Red Hat Red Hat Hardened Images · CVSS 7.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal - [Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds](https://agentprime.io/advisories/CVE-2026-88834.md) `CVE-2026-88834` · CVE record: Red Hat Red Hat Hardened Images · CVSS 3.7 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure - [Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions](https://agentprime.io/advisories/CVE-2026-88838.md) `CVE-2026-88838` · CVE record: Red Hat Red Hat Hardened Images · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-693 - [Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service](https://agentprime.io/advisories/CVE-2026-88833.md) `CVE-2026-88833` · CVE record: Red Hat Red Hat Hardened Images · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption - [Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix](https://agentprime.io/advisories/CVE-2026-108119.md) `CVE-2026-108119` · CVE record: Red Hat Red Hat Hardened Images and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Path traversal - [Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose](https://agentprime.io/advisories/CVE-2026-107935.md) `CVE-2026-107935` · CVE record: Red Hat Red Hat Build of Podman Desktop and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Path traversal - [Cups: null pointer dereference via embedded job ticket comments allows remote denial of service](https://agentprime.io/advisories/CVE-2026-107655.md) `CVE-2026-107655` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 4.0 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Memory corruption - [Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass](https://agentprime.io/advisories/CVE-2026-107445.md) `CVE-2026-107445` · CVE record: Red Hat Red Hat Hardened Images and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control - [Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass](https://agentprime.io/advisories/CVE-2026-107444.md) `CVE-2026-107444` · CVE record: Red Hat Red Hat Hardened Images and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control - [Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients](https://agentprime.io/advisories/CVE-2026-107161.md) `CVE-2026-107161` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption - [Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter](https://agentprime.io/advisories/CVE-2026-106033.md) `CVE-2026-106033` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS) - [Cups: cups: argument injection in mailto notifier via notify-recipient-uri](https://agentprime.io/advisories/CVE-2026-105326.md) `CVE-2026-105326` · CVE record: Red Hat Red Hat Hardened Images and 3 more · CVSS 2.5 Low · Not analysed yet · Published 5 Oct 2026 · Tags: Command injection - [Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader](https://agentprime.io/advisories/CVE-2026-95512.md) `CVE-2026-95512` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service - [Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag](https://agentprime.io/advisories/CVE-2026-103242.md) `CVE-2026-103242` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Memory corruption - [Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages](https://agentprime.io/advisories/CVE-2026-95520.md) `CVE-2026-95520` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption - [Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if](https://agentprime.io/advisories/CVE-2026-102010.md) `CVE-2026-102010` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.0 High · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption - [Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm](https://agentprime.io/advisories/CVE-2026-95521.md) `CVE-2026-95521` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [Rpm: code execution via macro expansion of manifest entries in \`rpmgi\` (\`-q -p\` / verify manifest flows)](https://agentprime.io/advisories/CVE-2026-95519.md) `CVE-2026-95519` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection - [Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello](https://agentprime.io/advisories/CVE-2026-88840.md) `CVE-2026-88840` · CVE record: Red Hat Red Hat Hardened Images · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption - [Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint](https://agentprime.io/advisories/CVE-2026-88839.md) `CVE-2026-88839` · CVE record: Red Hat Red Hat Hardened Images · CVSS 6.7 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption - [Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication](https://agentprime.io/advisories/CVE-2026-88837.md) `CVE-2026-88837` · CVE record: Red Hat Red Hat Hardened Images · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-305 - [Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages](https://agentprime.io/advisories/CVE-2026-88835.md) `CVE-2026-88835` · CVE record: Red Hat Red Hat Hardened Images · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption - [Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths](https://agentprime.io/advisories/CVE-2026-88831.md) `CVE-2026-88831` · CVE record: Red Hat Red Hat Hardened Images · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-636 - [Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow](https://agentprime.io/advisories/CVE-2026-88832.md) `CVE-2026-88832` · CVE record: Red Hat Red Hat Hardened Images · CVSS 7.3 High · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption - [Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow](https://agentprime.io/advisories/CVE-2026-88830.md) `CVE-2026-88830` · CVE record: Red Hat Red Hat Hardened Images · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption - [Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization](https://agentprime.io/advisories/CVE-2026-96512.md) `CVE-2026-96512` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control - [Gcc: libstdc++ integer overflow in \`new\` operator](https://agentprime.io/advisories/CVE-2026-95619.md) `CVE-2026-95619` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption - [Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)](https://agentprime.io/advisories/CVE-2026-93653.md) `CVE-2026-93653` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-606 - [Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute](https://agentprime.io/advisories/CVE-2026-76781.md) `CVE-2026-76781` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption - [Redis: redis: out-of-bounds read via crafted cluster bus packets](https://agentprime.io/advisories/CVE-2026-92925.md) `CVE-2026-92925` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption - [Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion](https://agentprime.io/advisories/CVE-2026-42784.md) `CVE-2026-42784` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 4 more · CVSS 7.4 High · Not analysed yet · Published 16 Sept 2026 · Tags: Weak cryptography or TLS - [Podman: arbitrary file write when importing oci archive](https://agentprime.io/advisories/CVE-2025-11395.md) `CVE-2025-11395` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-277 - [Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine](https://agentprime.io/advisories/CVE-2026-85234.md) `CVE-2026-85234` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption - [Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory](https://agentprime.io/advisories/CVE-2026-79699.md) `CVE-2026-79699` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal - [Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers](https://agentprime.io/advisories/CVE-2026-79705.md) `CVE-2026-79705` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 4.5 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal - [Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters](https://agentprime.io/advisories/CVE-2026-85013.md) `CVE-2026-85013` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.3 High · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection - [Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough](https://agentprime.io/advisories/CVE-2026-18495.md) `CVE-2026-18495` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Memory corruption Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .