Red Hat Red Hat Hardened Images

• CVE-2026-111253 Medium 6.6 Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction 0.1%
• CVE-2026-123151 High 7.5 Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail 0.5%
• CVE-2026-121997 High 8.1 Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch 0.7%
• CVE-2026-121996 High 8.2 Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length 0.5%
• CVE-2026-121995 High 7.5 Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail 0.3%
• CVE-2026-121994 High 8.8 Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length 0.5%
• CVE-2026-115456 Low 3.7 Gcc: out-of-bounds read in std::from_chars 0.2%
• CVE-2026-115455 Medium 6.5 Gcc: stack overflow in std::bitset on libstdc++ 0.3%
• CVE-2026-114691 Medium 5.9 Gcc: integer wrap in `std 0.4%
• CVE-2026-114690 Medium 6.2 Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std 0.1%
• CVE-2026-85498 Low 3.5 Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow 0.3%
• CVE-2026-115207 Medium 5.5 Patch: filename validation bypass in reversal fallback allows file creation outside the working directory 0.1%
• CVE-2026-114406 Medium 6.8 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 0.3%
• CVE-2026-85518 Medium 6.1 Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition 0.4%
• CVE-2026-114236 Low 3.3 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers 0.1%
• CVE-2026-92824 Medium 6.2 Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts 0.1%
• CVE-2026-92822 Medium 6.2 Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml 0.3%
• CVE-2026-92823 Medium 6.2 Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml 0.2%
• CVE-2026-16460 High 7.4 Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization <0.1%
• CVE-2026-17591 Low 3.6 Libarchive: libarchive: use-after-free via aliased mac metadata copy 0.2%
• CVE-2026-85977 Medium 5.3 Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding 0.4%
• CVE-2026-85231 Medium 6.5 Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding 0.3%
• CVE-2026-88842 Low 3.3 Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption 0.2%
• CVE-2026-88829 High 7.2 Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy 0.3%
• CVE-2026-90954 High 7.8 Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush 0.2%
• CVE-2026-88834 Low 3.7 Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds 0.2%
• CVE-2026-88838 Medium 5.5 Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions 0.1%
• CVE-2026-88833 Medium 6.5 Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service 0.2%
• CVE-2026-108119 Medium 6.3 Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix 0.1%
• CVE-2026-107935 Critical 9.3 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose 0.2%
• CVE-2026-107655 Medium 4.0 Cups: null pointer dereference via embedded job ticket comments allows remote denial of service 0.3%
• CVE-2026-107445 Medium 5.4 Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass 0.2%
• CVE-2026-107444 Medium 4.3 Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass 0.2%
• CVE-2026-107161 High 7.5 Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients 0.4%
• CVE-2026-106033 Medium 5.4 Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter 0.2%
• CVE-2026-105326 Low 2.5 Cups: cups: argument injection in mailto notifier via notify-recipient-uri 0.2%
• CVE-2026-95512 Medium 5.5 Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader 0.2%
• CVE-2026-103242 High 7.1 Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag 0.1%
• CVE-2026-95520 High 7.1 Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages 0.1%
• CVE-2026-102010 High 7.0 Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if 0.3%
• CVE-2026-95521 High 7.8 Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm 0.6%
• CVE-2026-95519 High 7.8 Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows) 0.1%
• CVE-2026-88840 Medium 5.3 Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello 0.2%
• CVE-2026-88839 Medium 6.7 Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint 0.1%
• CVE-2026-88837 Medium 6.5 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication 0.3%
• CVE-2026-88835 Medium 6.1 Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages 0.1%
• CVE-2026-88831 Medium 5.3 Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths 0.2%
• CVE-2026-88832 High 7.3 Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow 0.1%
• CVE-2026-88830 High 7.5 Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow 0.4%
• CVE-2026-96512 High 7.8 Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization 0.3%