Red Hat Red Hat Enterprise Linux 10
842 published vulnerabilities name this product. The 200 most recent are listed.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-85498 | | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow | LOW 3.5 | |||
| CVE-2026-117548 | | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service | MEDIUM 6.5 | |||
| CVE-2026-109411 | | Samba: access control bypass via vfs_ceph_rgw case-insensitive open | HIGH 8.1 | |||
| CVE-2026-116497 | | Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-115486 | | Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning | HIGH 7.1 | 0.2 % | ||
| CVE-2026-115485 | | Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-115484 | | Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg | HIGH 7.6 | 0.2 % | ||
| CVE-2026-115449 | | Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest | LOW 3.5 | 0.2 % | ||
| CVE-2026-115221 | | Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership | MEDIUM 5.4 | 0.1 % | ||
| CVE-2026-111079 | | Goose: goose: shell history and environment leak via terminal integration | HIGH 7.4 | 0.3 % | ||
| CVE-2026-115207 | | Patch: filename validation bypass in reversal fallback allows file creation outside the working directory | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-114406 | fixed in 0:2026.2.92_v9.0.319-100.3.el10_2 | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-85518 | | Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-114236 | | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers | LOW 3.3 | 0.1 % | ||
| CVE-2026-92824 | | Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-92823 | | Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-92822 | | Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-114038 | | Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-113496 | | Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments | MEDIUM 5.0 | 0.1 % | ||
| CVE-2026-113495 | | Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments | MEDIUM 5.0 | 0.2 % | ||
| CVE-2026-112177 | | Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8 | HIGH 7.3 | 0.4 % | ||
| CVE-2026-112261 | | Gimp: gimp: use-after-free in xcf loader via prop_selected_path | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112258 | | Gimp: gimp: use-after-free in xcf loader via prop_linked and prop_selection on channels | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112257 | | Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033) | HIGH 7.8 | 0.2 % | ||
| CVE-2026-112260 | | Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing | HIGH 7.1 | 0.2 % | ||
| CVE-2026-112259 | | Gimp: gimp: null pointer dereference in swatchbooker (sbz) palette import | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-112214 | | Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-112210 | | Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-16460 | | Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization | HIGH 7.4 | 0.1 % | ||
| CVE-2026-89096 | | Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-89088 | | Parted: parted: denial of service via heap buffer overflow during fat16 resize | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-89085 | | Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-111802 | | Nautilus: nautilus: arbitrary file deletion via trash symlink | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-17591 | | Libarchive: libarchive: use-after-free via aliased mac metadata copy | LOW 3.6 | 0.2 % | ||
| CVE-2026-62438 | | Gimp: gimp: paa integer overflow out-of-bounds read | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-62439 | | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability | HIGH 7.0 | 0.2 % | ||
| CVE-2026-85977 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-85231 | | Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-89098 | | Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-111581 | | Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method | LOW 3.3 | 0.1 % | ||
| CVE-2026-111555 | | Luksmeta: missing slot-range validation permits out-of-gap device i/o | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-104715 | | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass | HIGH 7.8 | 0.3 % | ||
| CVE-2026-110777 | | Evolution-data-server: local file disclosure via attach file:// uris | MEDIUM 5.7 | 0.4 % | ||
| CVE-2026-86849 | | Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-86856 | | Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86847 | | Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86846 | | Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86845 | | Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86566 | | Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings) | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-86848 | | Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto | HIGH 8.8 | 0.1 % | ||
| CVE-2026-86567 | | Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap | HIGH 8.8 | 0.1 % | ||
| CVE-2026-100236 | | Dpdk: dpdk: heap out-of-bounds read/write in gso header copy | HIGH 8.6 | 0.3 % | ||
| CVE-2026-86565 | | Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write | HIGH 8.2 | 0.2 % | ||
| CVE-2026-86563 | | Dpdk: dpdk: double offset bug in vhost log mapping calculation | HIGH 7.8 | 0.2 % | ||
| CVE-2026-86562 | | Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) | HIGH 7.8 | 0.2 % | ||
| CVE-2026-86561 | | Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-93683 | | Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-109968 | | Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-100229 | | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array boun… | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-109971 | | Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-109970 | | Clevis: clevis: pkcs#11 token pin written to world-readable file | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-109969 | | Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-100231 | | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for… | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-86476 | | Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and … | HIGH 8.4 | 0.2 % | ||
| CVE-2026-110036 | | Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices | LOW 3.3 | 0.2 % | ||
| CVE-2026-105460 | | Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-109976 | | Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-109833 | | Gnome-remote-desktop: heap buffer overflow in gnome-remote-desktop vnc tls peek buffer handling allows remote denial of service | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-109832 | | Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted) | HIGH 7.5 | 0.4 % | ||
| CVE-2026-109854 | | M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding | LOW 2.5 | 0.1 % | ||
| CVE-2026-108094 | | Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path | HIGH 7.8 | 0.1 % | ||
| CVE-2026-108093 | | Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-108063 | | Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-107935 | | Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose | CRITICAL 9.3 | 0.2 % | ||
| CVE-2026-107655 | | Cups: null pointer dereference via embedded job ticket comments allows remote denial of service | MEDIUM 4.0 | 0.3 % | ||
| CVE-2026-107565 | | Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption | MEDIUM 5.1 | 0.1 % | ||
| CVE-2026-107466 | | Flatpak-builder: local file exfiltration via `file | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-107161 | | Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients | HIGH 7.5 | 0.3 % | ||
| CVE-2026-106067 | | Gimp: gimp: heap buffer overflow in hot color filter on oversized image | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-106066 | | Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-106065 | | Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-107169 | | M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8 | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-107167 | | M17n-lib: heap use-after-free write in re_init_ic() | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-106064 | | Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-107170 | | M17n-lib: null dereference in minput_open_im() after failed m17n_init() | LOW 2.9 | 0.1 % | ||
| CVE-2026-107168 | | M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars() | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-106061 | | Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-80048 | | Sssd: sssd-kcm: local denial of service via excessive memory preallocation | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-104045 | | Sssd: sssd: denial of service via race condition in autofs responder | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104046 | | Sssd: sssd: denial of service via incomplete identity provider authentication requests | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-106062 | | Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-101258 | fixed in 0:10.02.1-16.el10_2.3 | Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free | HIGH 7.8 | 0.2 % | ||
| CVE-2026-106063 | | Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions | MEDIUM 6.3 | 0.1 % | ||
| CVE-2026-104048 | | Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation | HIGH 8.1 | 0.3 % | ||
| CVE-2026-104047 | | Sssd: sssd: information disclosure via query injection in entra id lookups | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-88252 | | Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104044 | | Sssd: sssd: denial of service via crafted passkey kerberos authentication request | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-104043 | | Sssd: sssd: denial of service via undersized packet parsing in nss responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104042 | | Sssd: sssd: denial of service via out-of-bounds read in pam responder | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-104041 | | Sssd: sssd: denial of service via unbounded negative cache growth | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104040 | | Sssd: sssd: information disclosure via odata injection in entra id lookups | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-104039 | | Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104038 | | Sssd: sssd: denial of service via missing sid extension in certificate mapping | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-104037 | | Sssd: sssd: denial of service via packet length underflow in autofs responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-92821 | | Sssd: sssd: access control bypass via premature ldap access rule evaluation | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-104036 | | Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin | MEDIUM 5.8 | 0.1 % | ||
| CVE-2026-104035 | | Sssd: sssd: denial of service via memory exhaustion in kcm responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104034 | | Sssd: sssd: denial of service via use-after-free in kcm ticket renewal | MEDIUM 4.7 | 0.1 % | ||
| CVE-2026-104033 | | Sssd: sssd: access control bypass via improper ldap shadow expiration check | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-104032 | | Sssd: sssd: denial of service via unprivileged autofs cache invalidation | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104031 | | Sssd: sssd: denial of service via memory exhaustion in autofs responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-104029 | | Sssd: sssd: denial of service via out-of-bounds read in autofs responder | LOW 3.3 | 0.1 % | ||
| CVE-2026-104030 | | Sssd: sssd: denial of service via out-of-bounds read during passkey parsing | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-105326 | | Cups: cups: argument injection in mailto notifier via notify-recipient-uri | LOW 2.5 | 0.2 % | ||
| CVE-2026-104988 | | Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject | HIGH 8.1 | 0.2 % | ||
| CVE-2026-94422 | | xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape | HIGH 8.7 | 0.5 % | ||
| CVE-2026-95512 | | Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-86345 | | 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result | CRITICAL 9.0 | 0.4 % | ||
| CVE-2026-86344 | | 389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue | HIGH 7.5 | 0.3 % | ||
| CVE-2026-103641 | | Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-103399 | | Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-103242 | | Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag | HIGH 7.1 | 0.1 % | ||
| CVE-2026-102560 | fixed in 0:3.6.5-3.el10_2.20 | Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-102559 | fixed in 0:3.6.5-3.el10_2.20 | Libsoup: libsoup: heap buffer overflow during websocket client-frame masking | HIGH 8.6 | 0.4 % | ||
| CVE-2026-102558 | fixed in 0:3.6.5-3.el10_2.20 | Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth | HIGH 8.6 | 0.4 % | ||
| CVE-2026-102555 | fixed in 0:3.6.5-3.el10_2.20 | Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding | HIGH 8.2 | 0.4 % | ||
| CVE-2026-102557 | fixed in 0:3.6.5-3.el10_2.20 | Libsoup: libsoup: heap buffer overflow during websocket message reassembly | HIGH 8.6 | 0.3 % | ||
| CVE-2026-102556 | fixed in 0:3.6.5-3.el10_2.20 | Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion | HIGH 8.6 | 0.3 % | ||
| CVE-2026-95520 | | Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages | HIGH 7.1 | 0.1 % | ||
| CVE-2026-97029 | | Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group | MEDIUM 5.7 | 0.2 % | ||
| CVE-2026-97024 | fixed in 0:1.16.0-9.el10_2.6 | Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc | HIGH 7.1 | 0.4 % | ||
| CVE-2026-97027 | | Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files | LOW 3.6 | 0.1 % | ||
| CVE-2026-97026 | | Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path | LOW 3.9 | 0.1 % | ||
| CVE-2026-97025 | | Flatpak: flatpak: world-readable oci authentication token in system-helper cache path | LOW 3.2 | 0.1 % | ||
| CVE-2026-102010 | fixed in 0:15.2.1-7.1.el10_2 | Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if | HIGH 7.0 | 0.3 % | ||
| CVE-2026-97023 | fixed in 0:1.16.0-9.el10_2.6 | Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin | HIGH 7.1 | 0.4 % | ||
| CVE-2026-96284 | | Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following | LOW 2.5 | 0.1 % | ||
| CVE-2026-96282 | | Flatpak: flatpak: extension metadata path traversal file existence oracle | LOW 3.1 | 0.2 % | ||
| CVE-2026-96283 | | Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull | LOW 3.3 | 0.1 % | ||
| CVE-2026-96281 | | Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-96280 | fixed in 0:1.16.0-9.el10_2.4 | Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems | HIGH 7.5 | 0.5 % | ||
| CVE-2026-96279 | | Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-93834 | | Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape | HIGH 8.8 | 0.4 % | ||
| CVE-2026-95521 | | Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm | HIGH 7.8 | 0.6 % | ||
| CVE-2026-95519 | | Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) | HIGH 7.8 | 0.1 % | ||
| CVE-2026-97185 | | Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file | HIGH 7.8 | 0.1 % | ||
| CVE-2026-96889 | fixed in 0:1.0.1-1.el10_2.2 | Librsvg: use-after-free when xml includes have duplicated entities | HIGH 7.8 | 0.5 % | ||
| CVE-2026-96546 | | Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader | LOW 2.5 | 0.2 % | ||
| CVE-2026-96545 | | Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-96541 | | Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline | HIGH 7.5 | 0.9 % | ||
| CVE-2026-96276 | | Flatpak: flatpak: arbitrary write in host context via flatpak build-init | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-96275 | fixed in 0:1.16.0-9.el10_2.4 | Flatpak: flatpak: arbitrary write access as root via extra-data extraction | HIGH 8.8 | 0.5 % | ||
| CVE-2026-96512 | fixed in 0:1.9.17-10.p2.el10_2.7 | Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization | HIGH 7.8 | 0.3 % | ||
| CVE-2026-96442 | fixed in 1:29.4-14.el10_2.3 | Emacs: emacs: arbitrary code execution in flymake mode | HIGH 7.8 | 0.2 % | ||
| CVE-2026-90462 | | Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-94640 | fixed in 0:1.2.7-3.el10_2.1 | Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service | HIGH 7.5 | 0.4 % | ||
| CVE-2026-95619 | | Gcc: libstdc++ integer overflow in `new` operator | HIGH 7.7 | 0.4 % | ||
| CVE-2026-95508 | | Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu | HIGH 7.4 | 0.6 % | ||
| CVE-2026-93433 | | Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92382 | | Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write | MEDIUM 4.1 | 0.1 % | ||
| CVE-2026-94184 | fixed in 0:6.4.38-3.el10_2.1 | Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) | HIGH 8.1 | 1.2 % | ||
| CVE-2026-80110 | fixed in 0:11.9.0-5.el10_2 | Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endp… | HIGH 8.1 | 0.2 % | ||
| CVE-2026-91202 | | Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-91203 | | Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-91205 | | Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-92768 | fixed in 0:348.1-1.el10_2 | Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92747 | fixed in 0:348.1-1.el10_2 | Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list | MEDIUM 5.0 | 0.2 % | ||
| CVE-2026-92745 | fixed in 0:348.1-1.el10_2 | Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments | MEDIUM 5.0 | 0.1 % | ||
| CVE-2026-91142 | | Cockpit: cockpit: unauthorized modification of login records via integer overflow | LOW 3.6 | 0.1 % | ||
| CVE-2026-91147 | | Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-91149 | | Cockpit: cockpit: denial of service via unbounded connection thread spawning | HIGH 7.5 | 0.3 % | ||
| CVE-2026-93676 | | Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks | LOW 3.2 | 0.1 % | ||
| CVE-2026-93653 | | Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-81627 | | Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram | HIGH 8.2 | 0.2 % | ||
| CVE-2026-89058 | | Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config | HIGH 7.4 | 0.3 % | ||
| CVE-2026-89059 | | Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-76781 | | Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-92925 | fixed in 0:8.0.7-1.el10_1 | Redis: redis: out-of-bounds read via crafted cluster bus packets | HIGH 7.1 | 0.7 % | ||
| CVE-2026-86320 | fixed in 0:1.4.4-1.el10_2.1 | Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`) | HIGH 7.8 | 0.3 % | ||
| CVE-2026-42784 | fixed in 0:1.10.2.1-1.el10_2 | Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion | HIGH 7.4 | 0.3 % | ||
| CVE-2026-92091 | | Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array | MEDIUM 5.9 | 0.6 % | ||
| CVE-2025-11395 | fixed in 2:1.43.1-7.el10_2 | Podman: arbitrary file write when importing oci archive | MEDIUM 5.5 | 0.4 % | ||
| CVE-2026-92248 | | Gimp: integer overflow when generating a thumbnail preview for a psd file | HIGH 7.8 | 0.2 % | ||
| CVE-2026-85234 | fixed in 0:5.2-50.el10_2 | Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine | HIGH 7.5 | 0.5 % | ||
| CVE-2026-79699 | | Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-79705 | | Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers | MEDIUM 4.5 | 0.4 % | ||
| CVE-2026-85013 | fixed in 0:5.6.1-2.el10_2.1 | Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters | HIGH 7.3 | 0.2 % | ||
| CVE-2026-91786 | | Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-19816 | | PackageKit: dnf5 backend ignores SIMULATE on RepoRemove | HIGH 7.1 | 0.1 % | ||
| CVE-2026-90996 | | Sssd: sssd: denial of service in nss responder via crafted zero-length requests | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-90995 | | Sssd: sssd: local denial of service due to null pointer dereference in pam responder | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-90994 | | Sssd: sssd: denial of service via malformed pam v1 requests | MEDIUM 4.0 | 0.2 % | ||
| CVE-2026-90463 | | Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`) | MEDIUM 4.0 | 0.1 % | ||
| CVE-2026-89329 | | Device-mapper-multipath: local denial of service via blocking ipc send operations | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-18495 | | Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-77159 | | Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-88914 | | Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-88924 | fixed in 0:1.54.4-4.el10_2.1 | Gvfs: gvfs-admin socket ownership race permits local root | HIGH 7.0 | 0.2 % | ||
| CVE-2026-84828 | | Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-88265 | | Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown | MEDIUM 5.6 | 0.1 % |