CVE Tools
Track your stack

Red Hat Enterprise Linux

11,230 CVEs tracked. 116 of them are in CISA KEV.

This hub aggregates every CVE we track for Red Hat Enterprise Linux, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Red Hat Enterprise Linux CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Red Hat Enterprise Linux CVEs per month
MonthCVEs
2024-12183
2025-01107
2025-02288
2025-03149
2025-04126
2025-05254
2025-06259
2025-07282
2025-0869
2025-09377
2025-10346
2025-1175
2025-12199
2026-01107
2026-0245
2026-03119
2026-0489
2026-0558
2026-0698
2026-0793
2026-0899
2026-09138
2026-10149
2026-1164

Severity

How the 11,230 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical9138%
  • High4,37439%
  • Medium5,42448%
  • Low5195%

Latest CVEs

The 15 most recently published vulnerabilities affecting Red Hat Enterprise Linux.

  1. CVE-2026-18379Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo8.8
  2. CVE-2026-127101Sssd: sssd: null pointer dereference in pam responder when protocol version negotiation is skipped5.5
  3. CVE-2026-127100Sssd: sssd: local denial of service through unchecked oauth2 json code type in pam responder5.5
  4. CVE-2026-127099Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion5.9
  5. CVE-2026-126831Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames5.5
  6. CVE-2026-121876Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers)7.9
  7. CVE-2026-127030Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length7.5
  8. CVE-2026-127029Freeradius: stack-based buffer overflow via unbounded eap-sim identity length7.5
  9. CVE-2026-126644Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory3.9
  10. CVE-2026-91151Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper7.3
  11. CVE-2026-108472Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin7.8
  12. CVE-2026-91150Cockpit: cockpit: denial of service via unbounded fragmented websocket messages7.5
  13. CVE-2026-123747Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions7.3
  14. CVE-2026-124746Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound5.5
  15. CVE-2026-124745Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory6.3

Product grouping is registry-driven, with AI assist and human review. How it works