Red Hat Red Hat OpenShift Container Platform 4

• CVE-2026-90995 Medium 5.5 Sssd: sssd: local denial of service due to null pointer dereference in pam responder 0.1%
• CVE-2026-90994 Medium 4.0 Sssd: sssd: denial of service via malformed pam v1 requests 0.2%
• CVE-2026-90463 Medium 4.0 Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`) 0.1%
• CVE-2026-89329 Medium 6.2 Device-mapper-multipath: local denial of service via blocking ipc send operations 0.2%
• CVE-2026-84828 Medium 6.5 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token 0.1%
• CVE-2026-88265 Medium 5.6 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown 0.1%
• CVE-2026-88264 Medium 5.6 Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs 0.1%
• CVE-2026-84042 High 7.8 Crun: crun: rootful krun with passt executes container payload as host root 0.1%
• CVE-2026-87876 Low 3.0 Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up) 0.3%
• CVE-2026-87875 Medium 4.3 Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound 0.4%
• CVE-2026-87853 High 7.5 Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation 0.3%
• CVE-2026-86564 Low 3.3 Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler 0.1%
• CVE-2026-74860 High 8.5 Libxml2: double-free/uaf in libxml2 python bindings 0.7%
• CVE-2026-86469 Medium 5.3 Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path 0.1%
• CVE-2026-81666 Medium 6.5 Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems 0.2%
• CVE-2026-81665 High 7.5 Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly 0.4%
• CVE-2026-78409 High 7.0 Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks 0.2%
• CVE-2026-78410 High 7.8 Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection 0.2%
• CVE-2026-78408 High 7.9 Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority 0.2%
• CVE-2026-18743 Low 2.5 Popt-devel: popt-static: short realloc in poptconfigfiletostring 0.1%
• CVE-2026-82327 Medium 5.5 Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data 0.2%
• CVE-2026-17113 Medium 6.0 Cri-o: cri-o: unvalidated image env var causes daemon crash 0.1%
• CVE-2026-19685 High 7.1 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615) 0.2%
• CVE-2026-77176 High 8.1 Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy 0.5%
• CVE-2026-77014 Medium 5.3 Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses 0.2%
• CVE-2026-43961 High 7.8 Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution 0.2%
• CVE-2026-66792 Critical 9.9 Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters 0.7%
• CVE-2026-58224 Medium 6.5 Samba: ctdb fails to do integrity checking of received packets 0.3%
• CVE-2026-19617 Medium 5.5 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser 0.2%
• CVE-2026-19730 Medium 4.2 Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives 0.1%
• CVE-2026-19548 Medium 5.5 Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing 0.2%
• CVE-2026-19078 Medium 4.3 Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter. 0.4%
• CVE-2026-72693 High 7.8 Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login 0.1%
• CVE-2026-6426 Medium 4.4 Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access 0.4%
• CVE-2026-18938 Medium 6.2 P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems 0.1%
• CVE-2026-19079 Medium 4.4 Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation 0.1%
• CVE-2026-18839 Low 2.2 Popt-devel: popt-static: size_t underflow in singleoptionhelp 0.1%
• CVE-2026-49331 Medium 6.5 Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths 0.2%
• CVE-2026-71227 Medium 5.1 Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return 0.2%
• CVE-2026-71226 High 7.3 Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path 0.1%
• CVE-2026-71225 Medium 6.5 Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries 0.3%
• CVE-2026-68743 Medium 5.5 Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1 0.1%
• CVE-2026-18739 Low 2.5 Popt-devel: popt-static: off-by-one in poptstuffargs 0.1%
• CVE-2026-68744 Low 3.3 Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply 0.1%
• CVE-2026-18477 Medium 4.4 Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape <0.1%
• CVE-2026-18508 Medium 4.4 Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite 0.1%
• CVE-2026-68742 Medium 5.5 Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr 0.1%
• CVE-2026-58216 Medium 5.3 Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash 0.5%
• CVE-2026-58222 High 8.8 Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes 0.8%
• CVE-2026-58218 Medium 5.3 Samba: dns signing dos via tkey name cache exhaustion 0.8%