Red Hat Red Hat OpenShift Container Platform 4

• CVE-2026-82976 High 7.1 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret 0.2%
• CVE-2026-120831 Medium 6.5 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service 0.3%
• CVE-2026-120830 High 7.4 Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure 0.2%
• CVE-2026-120194 High 7.5 Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 0.5%
• CVE-2026-115456 Low 3.7 Gcc: out-of-bounds read in std::from_chars 0.2%
• CVE-2026-115455 Medium 6.5 Gcc: stack overflow in std::bitset on libstdc++ 0.3%
• CVE-2026-114691 Medium 5.9 Gcc: integer wrap in `std 0.4%
• CVE-2026-114690 Medium 6.2 Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std 0.1%
• CVE-2026-118593 Medium 5.9 Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099) 0.2%
• CVE-2026-92092 High 7.4 Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification 0.2%
• CVE-2026-93009 Medium 4.3 Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder 0.2%
• CVE-2026-93010 Medium 4.3 Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check 0.2%
• CVE-2026-93006 Medium 6.8 Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content 0.3%
• CVE-2026-93007 Medium 5.3 Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation 0.4%
• CVE-2026-93011 Medium 5.3 Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms 0.6%
• CVE-2026-93008 Medium 6.8 Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations 0.1%
• CVE-2026-85498 Low 3.5 Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow 0.3%
• CVE-2026-109411 High 8.1 Samba: access control bypass via vfs_ceph_rgw case-insensitive open 0.6%
• CVE-2026-116497 Medium 5.5 Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon 0.1%
• CVE-2026-115449 Low 3.5 Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest 0.2%
• CVE-2026-115424 Medium 5.5 Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination 0.2%
• CVE-2026-114236 Low 3.3 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers 0.1%
• CVE-2026-92824 Medium 6.2 Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts 0.1%
• CVE-2026-92822 Medium 6.2 Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml 0.3%
• CVE-2026-92823 Medium 6.2 Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml 0.2%
• CVE-2026-114038 Medium 5.1 Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string 0.1%
• CVE-2026-16460 High 7.4 Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization <0.1%
• CVE-2026-89096 Medium 5.9 Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd 0.3%
• CVE-2026-85977 Medium 5.3 Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding 0.4%
• CVE-2026-85231 Medium 6.5 Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding 0.3%
• CVE-2026-89098 Medium 5.5 Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd 0.1%
• CVE-2026-111555 Medium 6.0 Luksmeta: missing slot-range validation permits out-of-gap device i/o 0.1%
• CVE-2026-104715 High 7.8 Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass 0.3%
• CVE-2026-92982 High 8.5 Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection 0.5%
• CVE-2026-86849 Medium 6.5 Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto 0.1%
• CVE-2026-86856 Medium 6.5 Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver 0.2%
• CVE-2026-86847 Medium 6.5 Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup 0.2%
• CVE-2026-86846 Medium 6.5 Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto 0.2%
• CVE-2026-86845 Medium 6.5 Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup 0.2%
• CVE-2026-86566 Medium 6.5 Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings) 0.2%
• CVE-2026-86848 High 8.8 Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto 0.1%
• CVE-2026-86567 High 8.8 Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap 0.2%
• CVE-2026-100236 High 8.6 Dpdk: dpdk: heap out-of-bounds read/write in gso header copy 0.4%
• CVE-2026-86565 High 8.2 Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write 0.2%
• CVE-2026-86563 High 7.8 Dpdk: dpdk: double offset bug in vhost log mapping calculation 0.2%
• CVE-2026-86562 High 7.8 Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse) 0.2%
• CVE-2026-86561 Medium 6.5 Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup 0.2%
• CVE-2026-93683 Medium 6.4 Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou 0.1%
• CVE-2026-109968 Medium 5.5 Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file <0.1%
• CVE-2026-109971 Medium 4.7 Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool 0.2%