Red Hat Red Hat OpenShift Container Platform 4.16

• CVE-2026-114406 Medium 6.8 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 0.3%
• CVE-2026-75888 High 7.7 Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch 0.4%
• CVE-2026-93017 High 7.7 Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader 0.4%
• CVE-2026-83589 Medium 6.1 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect 0.4%
• CVE-2026-62146 High 7.8 Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket 0.2%
• CVE-2026-75887 High 7.5 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler 0.5%
• CVE-2026-75885 Critical 9.3 Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint 0.7%
• CVE-2026-49329 High 7.5 Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints 0.7%
• CVE-2026-50236 High 7.4 Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console 0.5%
• CVE-2026-50237 High 7.4 Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console 0.5%
• CVE-2026-15816 High 7.5 Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() 0.4%
• CVE-2026-16313 High 7.6 Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export 0.3%
• CVE-2026-49332 High 8.5 Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams 0.5%
• CVE-2026-16242 Critical 9.4 Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates 0.9%
• CVE-2026-15809 High 7.8 Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env 0.2%
• CVE-2026-14476 High 8.0 Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass 0.7%
• CVE-2026-14474 High 8.8 Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation 0.6%
• CVE-2026-58014 High 7.3 Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" 0.6%
• CVE-2026-14164 High 7.5 Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack() 0.8%
• CVE-2026-6893 High 7.5 Dracut: dracut: root code execution via dhcp options command injection 1.3%
• CVE-2026-1784 High 8.8 Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection 0.2%
• CVE-2026-46579 High 7.4 Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend 0.4%
• CVE-2026-4408 Critical 9.0 Samba: remote code execution in samr 2.5%
• CVE-2026-1933 High 7.1 Samba: missing access check on reparse point operations 0.9%
• CVE-2026-2340 Medium 6.5 Samba: vfs_worm does not block directory modification 0.9%
• CVE-2026-3012 High 8.0 Samba: group policy certificate enrollment uses http:// without validation 0.3%
• CVE-2026-42013 High 8.2 Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name 0.4%
• CVE-2026-5260 High 8.2 Gnutls: gnutls: information disclosure via heap overread in rsa key exchange 0.8%
• CVE-2026-48864 High 7.8 Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data 0.2%
• CVE-2026-42009 High 7.5 Gnutls: gnutls: denial of service via dtls packet reordering vulnerability 1.3%
• CVE-2026-42011 High 7.4 Gnutls: gnutls: security bypass due to incorrect name constraint handling 0.5%
• CVE-2026-42010 High 7.1 Gnutls: gnutls: authentication bypass via nul character in username 1.1%
• CVE-2026-33846 High 7.5 Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment reassembly 1.3%
• CVE-2026-33845 High 7.5 Gnutls: gnutls: denial of service via dtls zero-length fragment 2.1%
• CVE-2026-3833 Medium 6.5 Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison 0.6%
• CVE-2026-4878 Medium 6.7 Libcap: libcap: privilege escalation via toctou race condition in cap_set_file() 0.2%
• CVE-2026-5121 High 7.5 Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing 1.1%
• CVE-2026-4424 High 7.5 Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing 1.3%
• CVE-2026-4111 High 7.5 Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive 0.7%
• CVE-2025-12801 Medium 6.5 Nfs-utils: rpc.mountd in the nfs-utils privilege escalation 0.5%
• CVE-2025-13601 High 7.7 Glib: integer overflow in in g_escape_uri_string() 0.3%
• CVE-2025-61662 High 7.8 Grub2: missing unregister call for gettext command may lead to use-after-free 0.2%
• CVE-2025-11561 High 8.8 Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems 0.8%
• CVE-2025-11234 High 7.5 Qemu-kvm: vnc websocket handshake use-after-free 0.9%
• CVE-2025-4953 High 7.4 Podman: build context bind mount 0.6%
• CVE-2025-9566 High 8.1 Podman: podman kube play command may overwrite host files 1.2%
• CVE-2025-7425 High 7.8 Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr 0.4%
• CVE-2025-5987 High 8.1 Libssh: invalid return code for chacha20 poly1305 with openssl backend 1.7%
• CVE-2025-5318 Medium 5.4 Libssh: out-of-bounds read in sftp_handle() 1.9%
• CVE-2025-6032 High 8.3 Podman: podman missing tls verification 0.5%