CVE Tools
Track your stack

Red Hat Update Infrastructure 5

60 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Red Hat Update Infrastructure 5, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Red Hat Update Infrastructure 5 CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Red Hat Update Infrastructure 5 CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-051
2025-061
2025-070
2025-080
2025-091
2025-100
2025-111
2025-123
2026-011
2026-021
2026-034
2026-045
2026-059
2026-0614
2026-074
2026-085
2026-094
2026-104
2026-112

Severity

How the 60 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical12%
  • High2440%
  • Medium3152%
  • Low47%

Latest CVEs

The 15 most recently published vulnerabilities affecting Red Hat Update Infrastructure 5.

  1. CVE-2026-123084Python-pulpcore: pulpcore: header content guard jq filter exposes the content-app environment6.5
  2. CVE-2026-84503Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce6.7
  3. CVE-2026-114406Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns6.8
  4. CVE-2026-89091Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution8.8
  5. CVE-2026-103870Pulp-rpm: distribution tree publish creates directories from .treeinfo ids5.0
  6. CVE-2026-103868Pulp-container: registry credentials are reused across remotes in a worker6.5
  7. CVE-2026-90959Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft8.1
  8. CVE-2026-96512Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization7.8
  9. CVE-2026-74860Libxml2: double-free/uaf in libxml2 python bindings8.5
  10. CVE-2026-84232Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content5.4
  11. CVE-2026-13732Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf7.0
  12. CVE-2026-78002Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function7.5
  13. CVE-2026-19654Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd7.5
  14. CVE-2026-18477Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape4.4
  15. CVE-2026-18508Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite4.4

Product grouping is registry-driven, with AI assist and human review. How it works