Red Hat Red Hat OpenShift Container Platform 5

• CVE-2026-104039 Medium 4.7 Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder 0.1%
• CVE-2026-104038 Medium 5.9 Sssd: sssd: denial of service via missing sid extension in certificate mapping 0.3%
• CVE-2026-104037 Medium 5.5 Sssd: sssd: denial of service via packet length underflow in autofs responder 0.1%
• CVE-2026-104036 Medium 5.8 Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin <0.1%
• CVE-2026-104035 Medium 5.5 Sssd: sssd: denial of service via memory exhaustion in kcm responder <0.1%
• CVE-2026-104034 Medium 4.7 Sssd: sssd: denial of service via use-after-free in kcm ticket renewal <0.1%
• CVE-2026-104033 Medium 5.4 Sssd: sssd: access control bypass via improper ldap shadow expiration check 0.2%
• CVE-2026-104032 Medium 5.5 Sssd: sssd: denial of service via unprivileged autofs cache invalidation <0.1%
• CVE-2026-104031 Medium 5.5 Sssd: sssd: denial of service via memory exhaustion in autofs responder <0.1%
• CVE-2026-104029 Low 3.3 Sssd: sssd: denial of service via out-of-bounds read in autofs responder 0.1%
• CVE-2026-104030 Medium 5.5 Sssd: sssd: denial of service via out-of-bounds read during passkey parsing 0.1%
• CVE-2026-83589 Medium 6.1 Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect 0.4%
• CVE-2026-101295 High 7.3 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction 0.1%
• CVE-2026-62146 High 7.8 Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket 0.2%
• CVE-2026-93834 High 8.8 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape 0.4%
• CVE-2026-94640 High 7.5 Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service 0.6%
• CVE-2026-95619 High 7.7 Gcc: libstdc++ integer overflow in `new` operator 0.4%
• CVE-2026-95508 High 7.4 Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu 0.6%
• CVE-2026-75939 High 7.4 Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed 0.4%
• CVE-2026-92574 High 8.8 Cri-o: cri-o checkpoint restore bypasses destination security context 0.7%
• CVE-2026-15801 High 8.0 Cri-o: cri-o: insufficient validation during container checkpoint restore 0.5%
• CVE-2026-81627 High 8.2 Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram 0.2%
• CVE-2026-76781 Medium 5.5 Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute 0.2%
• CVE-2026-79705 Medium 4.5 Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers 0.4%
• CVE-2026-90463 Medium 4.0 Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`) 0.1%
• CVE-2026-84042 High 7.8 Crun: crun: rootful krun with passt executes container payload as host root 0.1%
• CVE-2026-87853 High 7.5 Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation 0.3%
• CVE-2026-86469 Medium 5.3 Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path 0.1%
• CVE-2026-81666 Medium 6.5 Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems 0.2%
• CVE-2026-81665 High 7.5 Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly 0.4%
• CVE-2026-78409 High 7.0 Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks 0.2%
• CVE-2026-78410 High 7.8 Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection 0.2%
• CVE-2026-78408 High 7.9 Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority 0.2%
• CVE-2026-49329 High 7.5 Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints 0.7%
• CVE-2026-19685 High 7.1 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615) 0.2%
• CVE-2026-77176 High 8.1 Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy 0.5%
• CVE-2026-43961 High 7.8 Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution 0.2%
• CVE-2026-58224 Medium 6.5 Samba: ctdb fails to do integrity checking of received packets 0.3%
• CVE-2026-19617 Medium 5.5 Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser 0.2%
• CVE-2026-19730 Medium 4.2 Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives 0.1%
• CVE-2026-19548 Medium 5.5 Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing 0.2%
• CVE-2026-72693 High 7.8 Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login 0.1%
• CVE-2026-15816 High 7.5 Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() 0.4%
• CVE-2026-19079 Medium 4.4 Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation 0.1%
• CVE-2026-71227 Medium 5.1 Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return 0.2%
• CVE-2026-71226 High 7.3 Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path 0.1%
• CVE-2026-71225 Medium 6.5 Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries 0.3%
• CVE-2026-68743 Medium 5.5 Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1 0.1%
• CVE-2026-18477 Medium 4.4 Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape <0.1%
• CVE-2026-18508 Medium 4.4 Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite 0.1%