Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
111 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114406 | | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-96889 | fixed in 0:2.42.7-4.el8_6.1 | Librsvg: use-after-free when xml includes have duplicated entities | HIGH 7.8 | 0.5 % | ||
| CVE-2026-86320 | fixed in 0:1.0.9-4.el8_6 | Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`) | HIGH 7.8 | 0.3 % | ||
| CVE-2026-18147 | | Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url | HIGH 8.1 | 0.5 % | ||
| CVE-2026-87766 | | Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup | HIGH 8.8 | 0.2 % | ||
| CVE-2026-18922 | | 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl aux… | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-18453 | | 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search | HIGH 7.5 | 0.8 % | ||
| CVE-2026-18355 | | 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet() | HIGH 7.5 | 0.8 % | ||
| CVE-2026-76560 | | 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn | HIGH 7.5 | 0.6 % | ||
| CVE-2026-79678 | | Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service | HIGH 8.1 | 0.9 % | ||
| CVE-2026-76578 | | Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-81665 | | Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly | HIGH 7.5 | 0.4 % | ||
| CVE-2026-84268 | | Gvfs: sftp: heap-based buffer overflow in read_reply() | HIGH 8.8 | 0.6 % | ||
| CVE-2026-11861 | | Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships | CRITICAL 9.6 | 0.4 % | ||
| CVE-2026-73198 | | Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read | HIGH 7.5 | 0.5 % | ||
| CVE-2026-13097 | | Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore | HIGH 8.7 | 0.7 % | ||
| CVE-2026-73197 | | Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read | HIGH 7.5 | 0.5 % | ||
| CVE-2026-18917 | | Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow | HIGH 7.8 | 0.2 % | ||
| CVE-2026-73433 | | Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write | MEDIUM 6.6 | 0.1 % | ||
| CVE-2026-73434 | | Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-19550 | | Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes | HIGH 8.2 | 0.5 % | ||
| CVE-2026-72694 | fixed in 0:2.17.7-1.el8_6.1 | Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation | HIGH 7.1 | 0.1 % | ||
| CVE-2026-63622 | | Libvirt: swtpm privilege escalation via symlink following | HIGH 7.8 | 0.1 % | ||
| CVE-2026-19387 | | Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder | HIGH 7.6 | 0.4 % | ||
| CVE-2026-15816 | | Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() | HIGH 7.5 | 0.5 % | ||
| CVE-2026-18649 | | Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders | HIGH 7.5 | 1.0 % | ||
| CVE-2026-11770 | | 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check | HIGH 7.5 | 0.5 % | ||
| CVE-2026-15722 | | 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing | HIGH 7.5 | 0.8 % | ||
| CVE-2026-16529 | | Pcp: pcp: denial of service due to signed integer overflow | HIGH 7.5 | 0.5 % | ||
| CVE-2026-16527 | | Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules | HIGH 7.3 | 0.6 % | ||
| CVE-2026-16526 | | Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability | HIGH 8.8 | 0.6 % | ||
| CVE-2026-16524 | | Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection | HIGH 7.8 | 0.7 % | ||
| CVE-2026-16313 | | Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export | HIGH 7.6 | 0.3 % | ||
| CVE-2026-16445 | fixed in 0:049-203.git20220511.el8_6.1 | Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module | HIGH 7.5 | 3.2 % | ||
| CVE-2026-15588 | | Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-15711 | | Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation | HIGH 7.5 | 0.7 % | ||
| CVE-2026-15709 | | Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service | HIGH 7.5 | 0.9 % | ||
| CVE-2026-59692 | | Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59691 | | Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer | HIGH 7.1 | 0.3 % | ||
| CVE-2026-11610 | | 389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind | HIGH 8.8 | 0.5 % | ||
| CVE-2026-14476 | | Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass | HIGH 8.0 | 0.7 % | ||
| CVE-2026-14474 | | Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation | HIGH 8.8 | 0.6 % | ||
| CVE-2026-58016 | | Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-58015 | | Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive | HIGH 7.5 | 0.8 % | ||
| CVE-2026-58014 | | Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" | HIGH 8.6 | 0.6 % | ||
| CVE-2026-58013 | | Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" | HIGH 8.2 | 0.5 % | ||
| CVE-2026-58012 | | Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() | HIGH 8.2 | 0.5 % | ||
| CVE-2026-58011 | | Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime | HIGH 7.5 | 0.5 % | ||
| CVE-2026-58010 | | Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() | HIGH 8.2 | 0.5 % | ||
| CVE-2026-12912 | | Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image | HIGH 7.3 | 0.4 % | ||
| CVE-2026-13601 | | Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications | HIGH 7.1 | 0.2 % | ||
| CVE-2026-56208 | | Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode | HIGH 7.6 | 0.6 % | ||
| CVE-2026-10649 | | Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression | HIGH 8.6 | 0.6 % | ||
| CVE-2026-42014 | | Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin | MEDIUM 6.6 | 0.1 % | ||
| CVE-2026-52722 | | Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling | HIGH 7.1 | 0.4 % | ||
| CVE-2026-52720 | | Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb | HIGH 8.8 | 0.6 % | ||
| CVE-2026-53705 | | Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow | HIGH 7.6 | 0.4 % | ||
| CVE-2026-54231 | fixed in 0:2.10.9-25.el8_6.2 | Abrt: unsanitized systemd journal content written to dump directory files enables content injection | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-54230 | | Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites | HIGH 7.8 | 0.2 % | ||
| CVE-2026-54229 | | Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking | HIGH 7.0 | 0.1 % | ||
| CVE-2026-54228 | | Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories | HIGH 7.8 | 0.1 % | ||
| CVE-2026-11774 | | 389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow | HIGH 7.6 | 0.7 % | ||
| CVE-2026-6893 | | Dracut: dracut: root code execution via dhcp options command injection | HIGH 7.5 | 1.3 % | ||
| CVE-2026-11837 | fixed in 0:0.1.8-2.el8_6.1 | Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown | HIGH 7.3 | 0.2 % | ||
| CVE-2026-11788 | | 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser | HIGH 7.5 | 0.6 % | ||
| CVE-2026-50263 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow() | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-50262 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-50264 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat | HIGH 7.8 | 0.1 % | ||
| CVE-2026-50261 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter() | HIGH 7.8 | 0.2 % | ||
| CVE-2026-50260 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter() | HIGH 7.8 | 0.2 % | ||
| CVE-2026-50259 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing | HIGH 7.8 | 0.2 % | ||
| CVE-2026-50258 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels | HIGH 7.8 | 0.2 % | ||
| CVE-2026-50257 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence() | HIGH 7.8 | 0.1 % | ||
| CVE-2026-50256 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length m… | HIGH 7.8 | 0.2 % | ||
| CVE-2026-10805 | | Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-10118 | | Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication | HIGH 7.8 | 0.3 % | ||
| CVE-2026-4408 | | Samba: remote code execution in samr | CRITICAL 9.8 | 2.5 % | ||
| CVE-2026-1933 | | Samba: missing access check on reparse point operations | HIGH 7.1 | 0.9 % | ||
| CVE-2026-2340 | | Samba: vfs_worm does not block directory modification | MEDIUM 6.5 | 0.9 % | ||
| CVE-2026-3012 | | Samba: group policy certificate enrollment uses http:// without validation | HIGH 8.0 | 0.3 % | ||
| CVE-2026-42015 | | Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling | MEDIUM 5.3 | 0.7 % | ||
| CVE-2026-42013 | | Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name | HIGH 8.2 | 0.4 % | ||
| CVE-2026-42012 | | Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans | HIGH 7.1 | 0.4 % | ||
| CVE-2026-5260 | | Gnutls: gnutls: information disclosure via heap overread in rsa key exchange | HIGH 8.2 | 0.8 % | ||
| CVE-2026-48864 | | Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data | HIGH 7.8 | 0.2 % | ||
| CVE-2026-4480 | | Samba: samba: remote code execution in printing subsystem via unescaped job description | CRITICAL 9.8 | 14 % | ||
| CVE-2026-9064 | | 389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-42009 | | Gnutls: gnutls: denial of service via dtls packet reordering vulnerability | HIGH 7.5 | 1.3 % | ||
| CVE-2026-42011 | | Gnutls: gnutls: security bypass due to incorrect name constraint handling | HIGH 7.4 | 0.5 % | ||
| CVE-2026-42010 | | Gnutls: gnutls: authentication bypass via nul character in username | CRITICAL 9.8 | 1.1 % | ||
| CVE-2026-34002 | | Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-34000 | | Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing. | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-33846 | | Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly | HIGH 7.5 | 1.3 % | ||
| CVE-2026-33845 | | Gnutls: gnutls: denial of service via dtls zero-length fragment | CRITICAL 9.1 | 2.1 % | ||
| CVE-2026-3833 | | Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison | HIGH 7.4 | 0.6 % | ||
| CVE-2026-34003 | | Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access | HIGH 7.8 | 0.3 % | ||
| CVE-2026-34001 | | Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption | HIGH 7.8 | 0.3 % | ||
| CVE-2026-33999 | | Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling | HIGH 7.8 | 0.4 % | ||
| CVE-2026-4878 | | Libcap: libcap: privilege escalation via toctou race condition in cap_set_file() | HIGH 7.0 | 0.2 % | ||
| CVE-2026-5119 | | Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment | HIGH 8.2 | 0.3 % | ||
| CVE-2025-14831 | | Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification | MEDIUM 5.3 | 0.7 % | ||
| CVE-2025-10911 | | Libxslt: use-after-free with key data stored cross-rvt | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-5372 | | Libssh: incorrect return code handling in ssh_kdf() in libssh | HIGH 8.8 | 0.5 % | ||
| CVE-2025-49180 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension | HIGH 7.8 | 0.3 % | ||
| CVE-2025-49179 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension | HIGH 7.3 | 0.3 % | ||
| CVE-2025-49178 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-49176 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension | HIGH 7.3 | 0.4 % | ||
| CVE-2025-49175 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-6170 | | Libxml2: stack buffer overflow in xmllint interactive shell command handling | LOW 2.5 | 0.3 % | ||
| CVE-2024-12133 | | Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos | MEDIUM 5.3 | 1.1 % | ||
| CVE-2024-9355 | | Golang-fips: golang fips zeroed buffer | MEDIUM 6.5 | 0.3 % |