Red Hat Red Hat Enterprise Linux 10

• CVE-2026-103641 Medium 5.5 Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder 0.1%
• CVE-2026-103399 Medium 5.3 Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body 0.2%
• CVE-2026-103242 High 7.1 Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag 0.1%
• CVE-2026-102560 High 8.6 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth 0.5%
• CVE-2026-102559 High 8.6 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking 0.6%
• CVE-2026-102558 High 8.6 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth 0.6%
• CVE-2026-102555 High 8.2 Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding 0.5%
• CVE-2026-102557 High 8.6 Libsoup: libsoup: heap buffer overflow during websocket message reassembly 0.5%
• CVE-2026-102556 High 8.6 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion 0.5%
• CVE-2026-95520 High 7.1 Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages 0.1%
• CVE-2026-97029 Medium 5.7 Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group 0.2%
• CVE-2026-97024 High 7.1 Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc 0.5%
• CVE-2026-97027 Low 3.6 Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files 0.1%
• CVE-2026-97026 Low 3.9 Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path 0.1%
• CVE-2026-97025 Low 3.2 Flatpak: flatpak: world-readable oci authentication token in system-helper cache path 0.1%
• CVE-2026-102010 High 7.0 Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if 0.3%
• CVE-2026-97023 High 7.1 Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin 0.5%
• CVE-2026-96284 Low 2.5 Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following 0.1%
• CVE-2026-96282 Low 3.1 Flatpak: flatpak: extension metadata path traversal file existence oracle 0.2%
• CVE-2026-96283 Low 3.3 Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull 0.1%
• CVE-2026-96281 Medium 6.2 Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes 0.1%
• CVE-2026-96280 High 7.5 Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems 0.6%
• CVE-2026-96279 Medium 6.5 Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks 0.4%
• CVE-2026-93834 High 8.8 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape 0.4%
• CVE-2026-95521 High 7.8 Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm 0.6%
• CVE-2026-95519 High 7.8 Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) 0.1%
• CVE-2026-97185 High 7.8 Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file 0.1%
• CVE-2026-96889 High 7.8 Librsvg: use-after-free when xml includes have duplicated entities 0.6%
• CVE-2026-96546 Low 2.5 Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader 0.2%
• CVE-2026-96545 Medium 4.4 Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader 0.2%
• CVE-2026-96541 High 7.5 Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline 0.9%
• CVE-2026-96276 Medium 6.5 Flatpak: flatpak: arbitrary write in host context via flatpak build-init 0.4%
• CVE-2026-96275 High 8.8 Flatpak: flatpak: arbitrary write access as root via extra-data extraction 0.6%
• CVE-2026-96512 High 7.8 Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization 0.3%
• CVE-2026-96442 High 7.8 Emacs: emacs: arbitrary code execution in flymake mode 0.2%
• CVE-2026-90462 Medium 5.4 Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization 0.2%
• CVE-2026-94640 High 7.5 Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service 0.6%
• CVE-2026-95619 High 7.7 Gcc: libstdc++ integer overflow in `new` operator 0.4%
• CVE-2026-95508 High 7.4 Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu 0.6%
• CVE-2026-93433 Medium 5.5 Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing 0.2%
• CVE-2026-92382 Medium 4.1 Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write 0.1%
• CVE-2026-94184 Medium 5.3 Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) 1.2%
• CVE-2026-80110 High 8.1 Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint 0.2%
• CVE-2026-91202 Medium 6.1 Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste 0.1%
• CVE-2026-91203 Medium 6.0 Cockpit-files: cockpit-files: arbitrary file ownership and permission modification via symlink race condition 0.1%
• CVE-2026-91205 Medium 6.0 Cockpit-files: cockpit-files: local attacker can hijack file ownership via symlink race 0.1%
• CVE-2026-92768 Medium 5.5 Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments 0.2%
• CVE-2026-92747 Medium 5.0 Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list 0.2%
• CVE-2026-92745 Medium 5.0 Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments 0.1%
• CVE-2026-91142 Low 3.6 Cockpit: cockpit: unauthorized modification of login records via integer overflow 0.1%