Vendor
Red Hat
2,622 known vulnerabilities.
Products
910 results · Clear filters · Feed
-
High 7.5
Spice-server: spice: heap oob read/write via unchecked migration data offsets
A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds validation, allowing a malicious authenticated SPICE client during VM live migration to read arbitrary heap mem…
-
High 7.5
Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migration to trigger a massive heap buffer ove…
-
High 7.8CVE-2026-104715 Public exploit
Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sa…
-
High 7.1
Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can w…
-
High 7.4
Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRou…
-
High 8.8
Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a m…
-
High 8.5
Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitiza…
-
High 8.8
Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
-
High 8.8
Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
-
High 8.6
Dpdk: dpdk: heap out-of-bounds read/write in gso header copy
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can un…
-
High 8.2
Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
-
High 7.8
Dpdk: dpdk: double offset bug in vhost log mapping calculation
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
-
High 7.8
Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
-
High 8.8
Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. **fork()s** a child process 2. **setns()** into the target container's PI…
-
High 7.2
Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined sec…
-
High 7.8
Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two d…
-
High 8.4CVE-2026-86476 Public exploit
Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize
A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-che…
-
High 7.5
Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A r…
-
High 7.4
Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison
A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent networ…
-
High 7.7
Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fet…
-
High 7.8
Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path
A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progre…
-
High 8.8
YAML safe_load production fallback to unsafe_load enables RCE via deserialization
A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dia…
-
High 8.8
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), an…
-
High 7.7
Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster. Ref: https://gi…
-
High 7.5
Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients
A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size wh…
-
High 8.1
Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can…
-
High 7.8
Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file
A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small fo…
-
High 7.8
Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document pa…
-
High 7.1
Postgres-exporter: net/http/pprof exposed on metrics listener
A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information discl…
-
High 8.8
Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane
A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and…
-
High 8.1
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST s…
-
High 8.8
xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Fl…
-
High 7.5
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before…
-
High 8.8
Foreman: foreman: arbitrary code execution via safemode sandbox bypass
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engi…
-
High 7.7
Foreman: ssti and insecure deserialization in foreman-rake configuration
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution c…
-
High 8.2
Foreman: command injection in foreman-rake database tasks
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (…
-
High 8.2
Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is inten…
-
High 7.5
Foreman: unauthenticated information disclosure via provisioning token validation flaw
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than i…
-
High 8.8
Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to pr…
-
High 7.1
Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent ne…