Red Hat vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-118425 New	RH Red Hat Build of Keycloak Red Hat	6.8	–	Oct 29	Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback
CVE-2026-93009 New	RH Red Hat OpenStack Platform 13 (Queens) Red Hat	4.3	–	Oct 29	Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder
CVE-2026-93010 New	RH Red Hat Ceph Storage 9 Red Hat	4.3	–	Oct 29	Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check
CVE-2026-93006 New	RH Red Hat Enterprise Linux 8 Red Hat	6.8	–	Oct 29	Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content
CVE-2026-93007 New	RH Red Hat Enterprise Linux 6 Red Hat	5.3	–	Oct 29	Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation
CVE-2026-93011 New	RH Red Hat Enterprise Linux 9 Red Hat	5.3	–	Oct 29	Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms
CVE-2026-93008 New	RH Red Hat Enterprise Linux 8 Red Hat	6.8	–	Oct 29	Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations
CVE-2026-85498 New	RH Red Hat Enterprise Linux 9 Red Hat	3.5	–	Oct 29	Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
CVE-2026-118030 New	RH Red Hat Build of Keycloak Red Hat	4.2	–	Oct 29	Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
CVE-2026-117859 New	RH Red Hat Build of Keycloak Red Hat	5.4	–	Oct 29	Keycloak-services: keycloak-services: par single-use bypass via flow restart
CVE-2026-117688 New	RH Red Hat Build of Keycloak Red Hat	5.3	–	Oct 29	Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration
CVE-2026-117548 New	RH Red Hat Enterprise Linux 6 Red Hat	6.5	–	Oct 29	389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service
CVE-2026-117627 New	RH Red Hat Build of Keycloak Red Hat	5.4	–	Oct 29	Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
CVE-2026-114488 New	RH Red Hat Fuse 7 Red Hat	7.4	–	Oct 29	Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding
CVE-2026-19610 New	RH Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat	6.5	–	Oct 29	Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
CVE-2026-15564 New	RH Red Hat JBoss Enterprise Application Platform 8 Red Hat	7.4	–	Oct 29	Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
CVE-2026-117574 New	RH Red Hat OpenShift AI (RHOAI) Red Hat	9.1	–	Oct 28	Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization
CVE-2026-13451 New	RH Red Hat OpenShift AI (RHOAI) Red Hat	7.7	–	Oct 28	Kserve: kserve: server-side request forgery via malicious storageuri
CVE-2026-84725 New	RH Red Hat JBoss Enterprise Application Platform 7 Red Hat	8.1	–	Oct 28	Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap
CVE-2026-92171 New	RH Red Hat Data Grid 8 Red Hat	6.5	0%	Oct 26	Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store
CVE-2026-116497 New	RH Red Hat Enterprise Linux 9 Red Hat	5.5	0%	Oct 26	Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon
CVE-2026-115486 New	RH Red Hat Enterprise Linux 9 Red Hat	7.1	0%	Oct 23	Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning
CVE-2026-115485 New	RH Red Hat Enterprise Linux 8 Red Hat	6.3	0%	Oct 23	Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio
CVE-2026-115484 New	RH Red Hat Enterprise Linux 8 Red Hat	7.6	0%	Oct 23	Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg
CVE-2026-115449 New	RH Red Hat Enterprise Linux 10 Red Hat	3.5	0%	Oct 22	Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest
CVE-2026-115221 New	RH Red Hat Enterprise Linux 7 Red Hat	5.4	0%	Oct 22	Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership
CVE-2026-115424 New	RH Red Hat OpenShift Container Platform 4 Red Hat	5.5	0%	Oct 22	Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination
CVE-2026-111079	RH Red Hat Enterprise Linux 9 Red Hat	7.4	0%	Oct 22	Goose: goose: shell history and environment leak via terminal integration
CVE-2026-115207	RH Red Hat Enterprise Linux 6 Red Hat	5.5	0%	Oct 22	Patch: filename validation bypass in reversal fallback allows file creation outside the working directory
CVE-2026-114406	RH Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat	6.8	0%	Oct 21	Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
CVE-2026-85518	RH Red Hat Hardened Images Red Hat	6.1	0%	Oct 21	Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition
CVE-2026-114438	RH Red Hat Single Sign-On 7 Red Hat	4.2	0%	Oct 21	Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering
CVE-2026-110744	MG Multicluster Global Hub Red Hat	7.2	0%	Oct 21	Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide
CVE-2026-114370	RH Red Hat JBoss Enterprise Application Platform 8 Red Hat	3.7	0%	Oct 21	Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal
CVE-2026-114236	RH Red Hat Hardened Images Red Hat	3.3	0%	Oct 21	Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
CVE-2026-17557	RH Red Hat OpenShift AI (RHOAI) Red Hat	6.5	0%	Oct 21	Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
CVE-2026-92824	RH Red Hat OpenShift Container Platform 4 Red Hat	6.2	0%	Oct 21	Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts
CVE-2026-92822	RH Red Hat Enterprise Linux 10 Red Hat	6.2	0%	Oct 21	Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml
CVE-2026-92823	RH Red Hat Enterprise Linux 10 Red Hat	6.2	0%	Oct 21	Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml
CVE-2026-114038	RH Red Hat Enterprise Linux 6 Red Hat	5.1	0%	Oct 21	Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string
CVE-2026-105941	SF streams for Apache Kafka 3 Red Hat	8.1	0%	Oct 20	Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
CVE-2026-105949	SF streams for Apache Kafka 2 Red Hat	8.8	0%	Oct 20	Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
CVE-2026-105312	SC StreamsHub Console for Apache Kafka® Red Hat	9.9	0%	Oct 20	Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
CVE-2026-105311	SF streams for Apache Kafka 3 Red Hat	7.7	0%	Oct 20	Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
CVE-2026-113496	RH Red Hat Enterprise Linux 10 Red Hat	5.0	0%	Oct 20	Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments
CVE-2026-113495	RH Red Hat Enterprise Linux 9 Red Hat	5.0	0%	Oct 20	Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments
CVE-2026-112177	RH Red Hat Enterprise Linux 8 Red Hat	7.3	0%	Oct 20	Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
CVE-2026-112261	RH Red Hat Enterprise Linux 9 Red Hat	7.8	0%	Oct 19	Gimp: gimp: use-after-free in xcf loader via prop_selected_path
CVE-2026-112258	RH Red Hat Enterprise Linux 10 Red Hat	7.8	0%	Oct 19	Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels
CVE-2026-112257	RH Red Hat Enterprise Linux 6 Red Hat	7.8	0%	Oct 19	Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)
CVE-2026-112260	RH Red Hat Enterprise Linux 10 Red Hat	7.1	0%	Oct 19	Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing
CVE-2026-112259	RH Red Hat Enterprise Linux 9 Red Hat	5.5	0%	Oct 19	Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import
CVE-2026-112214	RH Red Hat Enterprise Linux 9 Red Hat	6.5	0%	Oct 19	Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser
CVE-2026-103314	RH Red Hat Advanced Cluster Security for Kubernetes 4.11 Red Hat	7.4	0%	Oct 19	Stackrox: stackrox: saml response replay allows multiple central authentication tokens
CVE-2026-112210	RH Red Hat Enterprise Linux 10 Red Hat	6.0	0%	Oct 19	Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
CVE-2026-16460	RH Red Hat Hardened Images Red Hat	7.4	0%	Oct 19	Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization
CVE-2026-89096	RH Red Hat OpenShift Container Platform 4 Red Hat	5.9	0%	Oct 16	Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
CVE-2026-89088	RH Red Hat Enterprise Linux 9 Red Hat	5.5	0%	Oct 16	Parted: parted: denial of service via heap buffer overflow during fat16 resize
CVE-2026-89085	RH Red Hat Enterprise Linux 8 Red Hat	6.6	0%	Oct 16	Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image
CVE-2026-111802	RH Red Hat Enterprise Linux 7 Red Hat	6.6	0%	Oct 16	Nautilus: nautilus: arbitrary file deletion via trash symlink