Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
117 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114406 | | Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-96280 | fixed in 0:1.12.9-3.el9_4.5 | Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems | HIGH 7.5 | 0.5 % | ||
| CVE-2026-96275 | fixed in 0:1.12.9-3.el9_4.5 | Flatpak: flatpak: arbitrary write access as root via extra-data extraction | HIGH 8.8 | 0.5 % | ||
| CVE-2026-96512 | | Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization | HIGH 7.8 | 0.3 % | ||
| CVE-2026-92925 | fixed in 9040020260917140622.9 | Redis: redis: out-of-bounds read via crafted cluster bus packets | HIGH 7.1 | 0.7 % | ||
| CVE-2026-86320 | | Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`) | HIGH 7.8 | 0.3 % | ||
| CVE-2026-88924 | | Gvfs: gvfs-admin socket ownership race permits local root | HIGH 7.0 | 0.2 % | ||
| CVE-2026-18147 | | Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url | HIGH 8.1 | 0.5 % | ||
| CVE-2026-87766 | | Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup | HIGH 8.8 | 0.2 % | ||
| CVE-2026-74860 | | Libxml2: double-free/uaf in libxml2 python bindings | HIGH 8.5 | 0.7 % | ||
| CVE-2026-76561 | | Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint) | HIGH 7.2 | 0.7 % | ||
| CVE-2026-18922 | | 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl aux… | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-18453 | | 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search | HIGH 7.5 | 0.8 % | ||
| CVE-2026-18355 | | 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet() | HIGH 7.5 | 0.8 % | ||
| CVE-2026-76560 | | 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn | HIGH 7.5 | 0.6 % | ||
| CVE-2026-79678 | | Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service | HIGH 8.1 | 0.9 % | ||
| CVE-2026-76578 | | Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-81665 | | Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly | HIGH 7.5 | 0.4 % | ||
| CVE-2026-84268 | | Gvfs: sftp: heap-based buffer overflow in read_reply() | HIGH 8.8 | 0.6 % | ||
| CVE-2026-17615 | | Resteasy-core: resteasy sourceprovider remote unauthenticated file read | HIGH 7.5 | 0.8 % | ||
| CVE-2026-78002 | | Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function | HIGH 7.5 | 1.1 % | ||
| CVE-2026-11861 | | Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships | CRITICAL 9.6 | 0.4 % | ||
| CVE-2026-73198 | | Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read | HIGH 7.5 | 0.5 % | ||
| CVE-2026-13097 | | Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore | HIGH 8.7 | 0.7 % | ||
| CVE-2026-73197 | | Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read | HIGH 7.5 | 0.5 % | ||
| CVE-2026-18917 | | Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow | HIGH 7.8 | 0.2 % | ||
| CVE-2026-19654 | | Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsys… | HIGH 7.5 | 0.6 % | ||
| CVE-2026-73433 | | Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write | MEDIUM 6.6 | 0.1 % | ||
| CVE-2026-73434 | | Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-19550 | | Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes | HIGH 8.2 | 0.5 % | ||
| CVE-2026-72694 | | Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation | HIGH 7.1 | 0.1 % | ||
| CVE-2026-63622 | | Libvirt: swtpm privilege escalation via symlink following | HIGH 7.8 | 0.1 % | ||
| CVE-2026-59090 | fixed in 2:2.99.8-4.el9_4.19 | Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-19389 | | Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read | HIGH 7.1 | 0.4 % | ||
| CVE-2026-19387 | | Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder | HIGH 7.6 | 0.4 % | ||
| CVE-2026-15816 | | Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() | HIGH 7.5 | 0.5 % | ||
| CVE-2026-18649 | | Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders | HIGH 7.5 | 1.0 % | ||
| CVE-2026-42169 | fixed in 2:2.99.8-4.el9_4.19 | Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c) | HIGH 7.8 | 0.1 % | ||
| CVE-2026-11770 | | 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check | HIGH 7.5 | 0.5 % | ||
| CVE-2026-15722 | | 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing | HIGH 7.5 | 0.8 % | ||
| CVE-2026-16529 | | Pcp: pcp: denial of service due to signed integer overflow | HIGH 7.5 | 0.5 % | ||
| CVE-2026-16527 | | Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules | HIGH 7.3 | 0.6 % | ||
| CVE-2026-16526 | | Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability | HIGH 8.8 | 0.6 % | ||
| CVE-2026-16524 | | Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection | HIGH 7.8 | 0.7 % | ||
| CVE-2026-16313 | | Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export | HIGH 7.6 | 0.3 % | ||
| CVE-2026-66758 | fixed in 2:2.99.8-4.el9_4.19 | Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images | HIGH 7.8 | 0.3 % | ||
| CVE-2026-15588 | | Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-16118 | | Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c | HIGH 7.1 | 0.2 % | ||
| CVE-2026-5674 | | Pipewire: pipewire: sandbox escape and arbitrary code execution via malicious library loading | HIGH 8.8 | 0.2 % | ||
| CVE-2026-15711 | | Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation | HIGH 7.5 | 0.7 % | ||
| CVE-2026-15709 | | Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service | HIGH 7.5 | 0.9 % | ||
| CVE-2026-59692 | | Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59691 | | Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer | HIGH 7.1 | 0.3 % | ||
| CVE-2026-11610 | | 389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind | HIGH 8.8 | 0.5 % | ||
| CVE-2026-14476 | | Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass | HIGH 8.0 | 0.7 % | ||
| CVE-2026-14474 | | Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation | HIGH 8.8 | 0.6 % | ||
| CVE-2026-58384 | fixed in 2:2.99.8-4.el9_4.19 | Gimp: gimp: integer overflow in read_rle_channel() | HIGH 7.8 | 0.3 % | ||
| CVE-2026-58380 | fixed in 2:2.99.8-4.el9_4.19 | Gimp: gimp: stack buffer overflow in pnmscanner_gettoken() | HIGH 7.8 | 0.3 % | ||
| CVE-2026-58379 | fixed in 2:2.99.8-4.el9_4.19 | Gimp: gimp: heap buffer overflow in read_channel_data() | HIGH 7.3 | 0.5 % | ||
| CVE-2026-58016 | | Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-58015 | | Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive | HIGH 7.5 | 0.8 % | ||
| CVE-2026-58014 | | Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" | HIGH 8.6 | 0.6 % | ||
| CVE-2026-58013 | | Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" | HIGH 8.2 | 0.5 % | ||
| CVE-2026-58012 | | Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() | HIGH 8.2 | 0.5 % | ||
| CVE-2026-58011 | | Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime | HIGH 7.5 | 0.5 % | ||
| CVE-2026-58010 | | Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() | HIGH 8.2 | 0.5 % | ||
| CVE-2026-14164 | | Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack() | HIGH 7.5 | 0.8 % | ||
| CVE-2026-12912 | | Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image | HIGH 7.3 | 0.4 % | ||
| CVE-2026-13601 | | Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications | HIGH 7.1 | 0.2 % | ||
| CVE-2026-55655 | | Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions | MEDIUM 6.1 | 0.1 % | ||
| CVE-2026-55653 | | Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to clien… | MEDIUM 6.5 | 0.5 % | ||
| CVE-2026-56208 | | Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode | HIGH 7.6 | 0.6 % | ||
| CVE-2026-10649 | | Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression | HIGH 8.6 | 0.6 % | ||
| CVE-2026-42014 | | Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin | MEDIUM 6.6 | 0.1 % | ||
| CVE-2026-52718 | fixed in 0:1.22.1-6.el9_4.4 | Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-52722 | | Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling | HIGH 7.1 | 0.4 % | ||
| CVE-2026-52720 | | Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb | HIGH 8.8 | 0.6 % | ||
| CVE-2026-53705 | | Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow | HIGH 7.6 | 0.4 % | ||
| CVE-2026-52719 | fixed in 0:1.22.1-6.el9_4.4 | Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder | HIGH 7.1 | 0.3 % | ||
| CVE-2026-11774 | | 389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow | HIGH 7.6 | 0.7 % | ||
| CVE-2026-6893 | | Dracut: dracut: root code execution via dhcp options command injection | HIGH 7.5 | 1.3 % | ||
| CVE-2026-11788 | | 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser | HIGH 7.5 | 0.6 % | ||
| CVE-2026-50263 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow() | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-50262 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-50264 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat | HIGH 7.8 | 0.1 % | ||
| CVE-2026-50261 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter() | HIGH 7.8 | 0.2 % | ||
| CVE-2026-50260 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter() | HIGH 7.8 | 0.2 % | ||
| CVE-2026-50259 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing | HIGH 7.8 | 0.2 % | ||
| CVE-2026-50258 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels | HIGH 7.8 | 0.2 % | ||
| CVE-2026-50257 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence() | HIGH 7.8 | 0.1 % | ||
| CVE-2026-50256 | | Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length m… | HIGH 7.8 | 0.2 % | ||
| CVE-2026-11332 | | Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution | HIGH 7.8 | 0.2 % | ||
| CVE-2026-10805 | | Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-5419 | | Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal | LOW 3.7 | 0.5 % | ||
| CVE-2026-43958 | | Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service | HIGH 7.8 | 0.2 % | ||
| CVE-2026-10118 | | Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication | HIGH 7.8 | 0.3 % | ||
| CVE-2026-4408 | | Samba: remote code execution in samr | CRITICAL 9.8 | 2.5 % | ||
| CVE-2026-1933 | | Samba: missing access check on reparse point operations | HIGH 7.1 | 0.9 % | ||
| CVE-2026-2340 | | Samba: vfs_worm does not block directory modification | MEDIUM 6.5 | 0.9 % | ||
| CVE-2026-3012 | | Samba: group policy certificate enrollment uses http:// without validation | HIGH 8.0 | 0.3 % | ||
| CVE-2026-42015 | | Gnutls: gnutls: memory corruption due to off-by-one error in pkcs#12 bag handling | MEDIUM 5.3 | 0.7 % | ||
| CVE-2026-42013 | | Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name | HIGH 8.2 | 0.4 % | ||
| CVE-2026-42012 | | Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans | HIGH 7.1 | 0.4 % | ||
| CVE-2026-5260 | | Gnutls: gnutls: information disclosure via heap overread in rsa key exchange | HIGH 8.2 | 0.8 % | ||
| CVE-2026-48864 | | Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data | HIGH 7.8 | 0.2 % | ||
| CVE-2026-4480 | | Samba: samba: remote code execution in printing subsystem via unescaped job description | CRITICAL 9.8 | 14 % | ||
| CVE-2026-9064 | | 389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-42009 | | Gnutls: gnutls: denial of service via dtls packet reordering vulnerability | HIGH 7.5 | 1.3 % | ||
| CVE-2026-42011 | | Gnutls: gnutls: security bypass due to incorrect name constraint handling | HIGH 7.4 | 0.5 % | ||
| CVE-2026-42010 | | Gnutls: gnutls: authentication bypass via nul character in username | CRITICAL 9.8 | 1.1 % | ||
| CVE-2026-33846 | | Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly | HIGH 7.5 | 1.3 % | ||
| CVE-2026-33845 | | Gnutls: gnutls: denial of service via dtls zero-length fragment | CRITICAL 9.1 | 2.1 % | ||
| CVE-2026-3833 | | Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison | HIGH 7.4 | 0.6 % | ||
| CVE-2026-5119 | | Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment | HIGH 8.2 | 0.3 % | ||
| CVE-2026-4887 | | Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image | HIGH 7.1 | 0.6 % | ||
| CVE-2025-10911 | | Libxslt: use-after-free with key data stored cross-rvt | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-6170 | | Libxml2: stack buffer overflow in xmllint interactive shell command handling | LOW 2.5 | 0.3 % |