Red Hat Red Hat Enterprise Linux 10

• CVE-2026-91147 Medium 5.9 Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash 0.6%
• CVE-2026-91149 High 7.5 Cockpit: cockpit: denial of service via unbounded connection thread spawning 0.6%
• CVE-2026-75883 Medium 6.8 Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service. 0.3%
• CVE-2026-93676 Low 3.2 Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks 0.1%
• CVE-2026-93653 Medium 5.5 Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) 0.2%
• CVE-2026-81627 High 8.2 Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram 0.2%
• CVE-2026-89058 High 7.4 Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config 0.5%
• CVE-2026-89059 High 7.5 Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) 1.5%
• CVE-2026-76781 Medium 5.5 Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute 0.2%
• CVE-2026-92925 High 7.1 Redis: redis: out-of-bounds read via crafted cluster bus packets 0.7%
• CVE-2026-86320 High 7.8 Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`) 0.3%
• CVE-2026-42784 High 7.4 Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion 0.3%
• CVE-2026-92091 Medium 5.9 Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array 0.6%
• CVE-2025-11395 Medium 5.5 Podman: arbitrary file write when importing oci archive 0.4%
• CVE-2026-92248 High 7.8 Gimp: integer overflow when generating a thumbnail preview for a psd file 0.2%
• CVE-2026-85234 High 7.5 Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine 0.5%
• CVE-2026-79699 Medium 4.4 Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory 0.2%
• CVE-2026-79705 Medium 4.5 Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers 0.4%
• CVE-2026-85013 High 7.3 Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters 0.2%
• CVE-2026-91786 Medium 6.1 Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size 0.1%
• CVE-2026-19816 High 7.1 PackageKit: dnf5 backend ignores SIMULATE on RepoRemove 0.1%
• CVE-2026-90996 Medium 4.0 Sssd: sssd: denial of service in nss responder via crafted zero-length requests 0.1%
• CVE-2026-90995 Medium 5.5 Sssd: sssd: local denial of service due to null pointer dereference in pam responder 0.1%
• CVE-2026-90994 Medium 4.0 Sssd: sssd: denial of service via malformed pam v1 requests 0.2%
• CVE-2026-90463 Medium 4.0 Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`) 0.1%
• CVE-2026-89329 Medium 6.2 Device-mapper-multipath: local denial of service via blocking ipc send operations 0.2%
• CVE-2026-18495 Medium 6.1 Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough 0.1%
• CVE-2026-77159 Medium 5.5 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink 0.2%
• CVE-2026-88914 Medium 4.4 Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser 0.1%
• CVE-2026-88924 High 7.0 Gvfs: gvfs-admin socket ownership race permits local root 0.2%
• CVE-2026-84828 Medium 6.5 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token 0.1%
• CVE-2026-88265 Medium 5.6 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown 0.1%
• CVE-2026-88264 Medium 5.6 Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs 0.1%
• CVE-2026-84042 High 7.8 Crun: crun: rootful krun with passt executes container payload as host root 0.1%
• CVE-2026-18147 High 8.1 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url 0.6%
• CVE-2026-87876 Low 3.0 Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up) 0.3%
• CVE-2026-87875 Medium 4.3 Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound 0.4%
• CVE-2026-87853 High 7.5 Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation 0.3%
• CVE-2026-87766 High 8.8 Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup 0.2%
• CVE-2026-86564 Low 3.3 Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler 0.1%
• CVE-2026-18090 Medium 6.1 Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block 0.2%
• CVE-2026-74860 High 8.5 Libxml2: double-free/uaf in libxml2 python bindings 0.7%
• CVE-2026-76561 High 7.2 Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint) 0.8%
• CVE-2026-86469 Medium 5.3 Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path 0.1%
• CVE-2026-19843 High 8.4 389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor 0.5%
• CVE-2026-18922 Critical 9.8 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property 0.6%
• CVE-2026-18453 High 7.5 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search 0.8%
• CVE-2026-18355 High 7.5 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet() 0.8%
• CVE-2026-76560 High 7.5 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn 0.6%
• CVE-2026-79678 High 8.1 Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service 0.9%