CVE Tools
Track your stack

Red Hat Enterprise Linux

11,208 CVEs tracked. 116 of them are in CISA KEV.

This hub aggregates every CVE we track for Red Hat Enterprise Linux, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Red Hat Enterprise Linux CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Red Hat Enterprise Linux CVEs per month
MonthCVEs
2024-12183
2025-01107
2025-02288
2025-03149
2025-04126
2025-05254
2025-06259
2025-07282
2025-0869
2025-09377
2025-10346
2025-1175
2025-12199
2026-01107
2026-0245
2026-03119
2026-0489
2026-0558
2026-0698
2026-0793
2026-0899
2026-09138
2026-10150
2026-1141

Severity

How the 11,208 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical9138%
  • High4,36239%
  • Medium5,41548%
  • Low5185%

Latest CVEs

The 15 most recently published vulnerabilities affecting Red Hat Enterprise Linux.

  1. CVE-2026-121885Podman: untrusted image labels allow auto-update to restart arbitrary systemd units6.5
  2. CVE-2026-124747Busybox: heap buffer overflow in wget ftp resume when the resume offset exceeds the reported file size7.5
  3. CVE-2026-125709Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.4.2
  4. CVE-2026-125707Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table6.1
  5. CVE-2026-125706Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing5.5
  6. CVE-2026-125712Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsing7.5
  7. CVE-2026-125703Gst-plugins-bad: gst-plugins-bad: bounds check errors in mxf vanc packet handling5.5
  8. CVE-2026-125672Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option6.6
  9. CVE-2026-125704Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization7.5
  10. CVE-2026-122056Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service5.9
  11. CVE-2026-112314Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries7.5
  12. CVE-2026-112321Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths7.5
  13. CVE-2026-112320Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching7.5
  14. CVE-2026-112319Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation6.5
  15. CVE-2026-112318Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers6.5

Product grouping is registry-driven, with AI assist and human review. How it works