Red Hat Red Hat Hardened Images

• CVE-2026-95619 High 7.7 Gcc: libstdc++ integer overflow in `new` operator 0.4%
• CVE-2026-93653 Medium 5.5 Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) 0.2%
• CVE-2026-76781 Medium 5.5 Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute 0.2%
• CVE-2026-92925 High 7.1 Redis: redis: out-of-bounds read via crafted cluster bus packets 0.7%
• CVE-2026-42784 High 7.4 Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion 0.3%
• CVE-2025-11395 Medium 5.5 Podman: arbitrary file write when importing oci archive 0.4%
• CVE-2026-85234 High 7.5 Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine 0.5%
• CVE-2026-79699 Medium 4.4 Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory 0.2%
• CVE-2026-79705 Medium 4.5 Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers 0.4%
• CVE-2026-85013 High 7.3 Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters 0.2%
• CVE-2026-18495 Medium 6.1 Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough 0.1%
• CVE-2026-88265 Medium 5.6 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown 0.1%
• CVE-2026-88264 Medium 5.6 Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs 0.1%
• CVE-2026-84042 High 7.8 Crun: crun: rootful krun with passt executes container payload as host root 0.1%
• CVE-2026-87876 Low 3.0 Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up) 0.3%
• CVE-2026-87875 Medium 4.3 Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound 0.4%
• CVE-2026-87766 High 8.8 Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup 0.2%
• CVE-2026-74860 High 8.5 Libxml2: double-free/uaf in libxml2 python bindings 0.7%
• CVE-2026-86469 Medium 5.3 Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path 0.1%
• CVE-2026-84838 High 7.8 Rpm: command injection in rpmuncompress via unescaped filenames passed to popen() 1.1%
• CVE-2026-84837 High 7.8 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path 0.7%
• CVE-2026-78409 High 7.0 Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks 0.2%
• CVE-2026-78410 High 7.8 Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection 0.2%
• CVE-2026-78408 High 7.9 Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority 0.2%
• CVE-2026-84233 High 7.0 Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames 0.2%
• CVE-2026-18743 Low 2.5 Popt-devel: popt-static: short realloc in poptconfigfiletostring 0.1%
• CVE-2026-13732 High 7.0 Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf 0.1%
• CVE-2026-82327 Medium 5.5 Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data 0.2%
• CVE-2026-19685 High 7.1 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615) 0.2%
• CVE-2026-78367 High 7.0 Rpm: rpmbuild gettarspec() crafted tar member name → macro injection 0.2%
• CVE-2026-43961 High 7.8 Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution 0.2%
• CVE-2026-19617 Medium 5.5 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser 0.2%
• CVE-2026-19730 Medium 4.2 Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives 0.1%
• CVE-2026-19548 Medium 5.5 Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing 0.2%
• CVE-2026-72693 High 7.8 Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login 0.1%
• CVE-2026-15816 High 7.5 Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() 0.4%
• CVE-2026-18938 Medium 6.2 P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems 0.1%
• CVE-2026-19079 Medium 4.4 Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation 0.1%
• CVE-2026-18839 Low 2.2 Popt-devel: popt-static: size_t underflow in singleoptionhelp 0.1%
• CVE-2026-44605 Medium 5.5 Rpm: heap buffer overflow in ndb slot table parsing 0.2%
• CVE-2026-71227 Medium 5.1 Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return 0.2%
• CVE-2026-71226 High 7.3 Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path 0.1%
• CVE-2026-71225 Medium 6.5 Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries 0.3%
• CVE-2026-18739 Low 2.5 Popt-devel: popt-static: off-by-one in poptstuffargs 0.1%
• CVE-2026-18477 Medium 4.4 Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape <0.1%
• CVE-2026-18508 Medium 4.4 Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite 0.1%
• CVE-2026-18220 High 7.8 Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing 0.2%
• CVE-2026-15003 Medium 5.6 Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service 0.2%
• CVE-2026-16730 Medium 5.5 Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup 0.2%
• CVE-2026-16517 Low 2.9 Libarchive: libarchive: signed integer overflow in archive_write_zip_header 0.1%