Red hat enterprise linux

This hub aggregates every CVE we track for Red hat enterprise linux, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Red hat enterprise linux.

• CVE-2026-19548Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing5.5Aug 12, 2026
• CVE-2026-18663389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control5.9Aug 12, 2026
• CVE-2026-19550Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes4.3Aug 11, 2026
• CVE-2026-14180Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap5.3Aug 11, 2026
• CVE-2026-19546Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute8.8Aug 11, 2026
• CVE-2026-71218Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion5.3Aug 11, 2026
• CVE-2026-71217Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion7.5Aug 11, 2026
• CVE-2026-72693Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login7.8Aug 11, 2026
• CVE-2026-72694Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation7.1Aug 11, 2026
• CVE-2026-19391Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives6.5Aug 11, 2026
• CVE-2026-6426Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access4.4Aug 10, 2026
• CVE-2026-19411Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null3.9Aug 10, 2026
• CVE-2026-63622Libvirt: swtpm privilege escalation via symlink following7.8Aug 10, 2026
• CVE-2026-59091Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file7.3Aug 10, 2026
• CVE-2026-63623Libvirt: information disclosure via world-readable storage volume images during clone/convert5.5Aug 10, 2026