Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 02:05 UTC

Critical in the last 24 hours

1603 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

144-76% vs 7-day avg of 597

2 critical, 38 high, 59 medium, 25 low

261 advisories match Clear all Export 25 shown as CSV

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.1	CVE-2026-115486	A flaw was found in the iscsiuio component of open-iscsi Red Hat, open-iscsiRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, open-iscsi iscsiuio	NVD	Oct 23 01:16 UTC
CVE-2026-115486A flaw was found in the iscsiuio component of open-iscsi Executive summary A flaw in the iscsiuio component of open-iscsi lets an attacker on the same network segment send crafted IPv6 Neighbor Discovery packets that poison the ARP table and redirect traffic within the iSCSI storage network. The advisory rates it Moderate, with a preliminary CVSS v3.1 base score of 7.1 from Red Hat and cve.org, and says systems without iSCSI offload hardware are not affected. The advisory does not state a fixed version or a vendor release date, but it recommends keeping iscsiuio-managed interfaces on trusted Layer 2 segments and filtering ICMPv6 Neighbor Advertisement and Neighbor Solicitation messages from untrusted sources where operationally acceptable. Technical summary The flaw is classified as CWE-125 (out-of-bounds read). The IPv6 Neighbor Discovery handler reads link-layer address options at a fixed offset without checking that the packet contains them, and it updates the ARP table unconditionally with addresses taken from packet headers. Exploitation requires an attacker with adjacent-network access to a Layer 2 segment where iscsiuio processes IPv6 NDP traffic on a hardware iSCSI offload NIC; the iscsiuio daemon is socket-activated and runs only when that hardware is present and configured. The CVSS v3.1 vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L with a base score of 7.1. Affected and fixed version numbers are not stated, no patch or fixed release is named, and detection guidance is not stated beyond the mitigation advice to filter ICMPv6 types 135 and 136 from untrusted sources. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-115486 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityLow How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Affects Red Hat open-iscsi Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 6 open-iscsi iscsiuio NIST National Vulnerability DatabasePublished Oct 23, 2026 01:16 UTC Read the advisory
	Medium	6.3	CVE-2026-115485	A flaw was found in the iscsiuio component of open-iscsi Red Hat, open-iscsiRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, open-iscsi iscsiuio	NVD	Oct 23 01:16 UTC
CVE-2026-115485A flaw was found in the iscsiuio component of open-iscsi Executive summary A flaw in the iscsiuio component of open-iscsi can let a nearby attacker on the same network segment crash a daemon or corrupt an iSCSI initiator name by sending a crafted DHCPv6 message. The advisory rates it Moderate, with a CVSS v3.1 base score of 6.3 from Red Hat and cve.org, and says systems without iSCSI offload hardware are not affected. The advisory's mitigation guidance is to disable DHCPv6 handling for the affected interface if it is not needed, or otherwise restrict exposure to trusted adjacent networks and filter forged DHCPv6 server traffic; it does not state a fixed version. Technical summary The vulnerability is an out-of-bounds read (CWE-125) in the DHCPv6 vendor option parser of iscsiuio, where strlen() is called on network data without a guaranteed NUL terminator, causing a read into heap memory and a 1-byte heap overwrite. Exploitation requires an attacker on the same Layer 2 segment who sends a crafted DHCPv6 Advertise message during the solicit phase, on a system with a hardware iSCSI offload NIC where iscsiuio is active. The CVSS v3.1 vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, scored 6.3 by Red Hat and cve.org, with NVD showing N/A. Affected and fixed version numbers are not stated, and no patch or vendor fix release is named. Mitigations are disabling DHCPv6 handling on the interface or using firewall rules against forged DHCPv6 server traffic; detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-115485 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affects Red Hat open-iscsi Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 6 open-iscsi iscsiuio NIST National Vulnerability DatabasePublished Oct 23, 2026 01:16 UTC Read the advisory
	High	7.6	CVE-2026-115484	A flaw was found in the iscsiuio component of open-iscsi Red Hat, open-iscsiRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, open-iscsi iscsiuio	NVD	Oct 23 01:16 UTC
CVE-2026-115484A flaw was found in the iscsiuio component of open-iscsi Executive summary A flaw in the iscsiuio component of open-iscsi lets an attacker on the same local network segment send a crafted DHCP response that can crash the daemon or corrupt its network configuration. The advisory rates it Moderate and says systems without iSCSI offload hardware are not affected. The advisory recommends restricting untrusted systems from the Layer 2 broadcast domain, using static IP addressing where DHCP is not required, and limiting DHCP/BOOTP traffic to trusted infrastructure. Technical summary The flaw is an out-of-bounds read (CWE-125) in the DHCPv4 option parser of iscsiuio, which miscalculates the length of options data and reads past a heap buffer. Exploitation requires adjacent-network access to a Layer 2 segment where iscsiuio processes IPv4 DHCP traffic on a hardware iSCSI offload NIC (Broadcom bnx2/bnx2x or QLogic qedi), and no privileges or user interaction are required. The advisory gives CVSS v3.1 base score 7.6 with vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H, and notes that NVD shows no score of its own. Affected and fixed package versions are not stated, and no fixed version is given. Mitigations are network isolation, static addressing, and DHCP/BOOTP filtering; the advisory gives no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-115484 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Affects Red Hat open-iscsi Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 6 open-iscsi iscsiuio NIST National Vulnerability DatabasePublished Oct 23, 2026 01:16 UTC Read the advisory
	Low	3.5	CVE-2026-115449	A flaw was found in libslirp Red Hat, libslirpRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, libslirp	NVD	Oct 22 22:18 UTC
CVE-2026-115449A flaw was found in libslirp Executive summary A flaw in libslirp, the user-mode networking library used by some virtual machine setups, can leak the host's real IP address to a guest system. Red Hat rates it as low severity, with a CVSS v3 base score of 3.5 in its own assessment, and the flaw only occurs under specific conditions. The advisory describes the normal ICMP path as unaffected and recommends ensuring the QEMU user's group is in ping_group_range, or avoiding user-mode networking. Technical summary The issue is a CWE-200 information exposure caused by an ICMP echo reply length that is not updated to match the data received from the host. It occurs only when the SOCK_DGRAM ICMP socket is unavailable and libslirp falls back to a raw socket, such as when ping_group_range is restricted, and the guest pings a nonexistent host on the hypervisor's LAN. The advisory says the attack vector is network with high complexity and low privileges required, and the Red Hat CVSS vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N. The advisory says the leak is limited to 4 bytes of host IP address and not arbitrary heap memory. Mitigations are to include the QEMU process user's GID in net.ipv4.ping_group_range or to use --net none or virtio-net with a TAP backend. Affected and fixed version numbers, and detection guidance, are not stated in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-115449 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N Affects Red Hat libslirp Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat OpenShift Container Platform 4 libslirp NIST National Vulnerability DatabasePublished Oct 22, 2026 22:18 UTC Read the advisory
	Medium	5.5	CVE-2026-115424	A flaw was found in the OpenShift client oc Red HatRed Hat OpenShift Container Platform 4, Red Hat OpenShift, Red Hat oc	NVD	Oct 22 22:18 UTC
CVE-2026-115424A flaw was found in the OpenShift client oc Executive summary A flaw in the OpenShift command-line client oc lets a malicious container image write files outside the intended extraction folder when a user runs oc image extract. The advisory rates it 5.5 (Medium) on Red Hat's CVSS v3.1 score and says the affected versions are still being determined, so no fixed release is named yet. Until an updated oc client is available, the vendor recommends extracting only from trusted container images. Technical summary The weakness is a symbolic and hard link target validation bypass (CWE-61, UNIX symbolic link following) in oc image extract. Symlink and hardlink targets can point to absolute paths or to sibling directories, and a string-prefix containment check lets them pass, so later archive entries are written through the planted link. Exploitation requires a user to extract a malicious image (CVSS AV:L/AC:L/PR:N/UI:R, integrity impact High, no confidentiality or availability impact). Affected versions are not yet stated, and no fixed version is stated. The advisory says no configuration option disables only this behavior, so the workarounds are to treat images as trusted, run as an unprivileged user into an isolated destination, avoid fixed predictable paths in CI, and restrict who can change image references. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-115424 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affects Red Hat Red Hat OpenShift Container Platform 4 Red Hat OpenShift Red Hat oc NIST National Vulnerability DatabasePublished Oct 22, 2026 22:18 UTC Read the advisory
	Medium	5.4	CVE-2026-115221	A flaw was found in FreeIPA Red Hat, FreeIPARed Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, FreeIPA	NVD	Oct 22 22:18 UTC
CVE-2026-115221A flaw was found in FreeIPA Executive summary A flaw in FreeIPA, an identity management product, lets an authenticated enrolled host retrieve and revoke digital certificates belonging to other users or services. The advisory rates it as medium severity with a CVSS v3.1 base score of 5.4 from Red Hat and cve.org, and NVD shows N/A for that score. The advisory does not state a fix or vendor recommendation beyond the general options described in its FAQ. Technical summary This is an incorrect authorization flaw (CWE-863) in FreeIPA, where certificate ownership is verified only by matching the host name to the certificate subject Common Name without checking the directory service. Exploitation requires network access and low-privileged authenticated access as an enrolled host, with no user interaction; the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. Affected and fixed versions are not stated in the advisory text, and no workaround or detection guidance is given. The advisory also does not state whether any exploitation in the wild has occurred. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-115221 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects Red Hat FreeIPA Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 6 FreeIPA NIST National Vulnerability DatabasePublished Oct 22, 2026 22:18 UTC Read the advisory
	Medium	5.5	CVE-2026-115207	A flaw was found in GNU patch Red Hat, GNURed Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat Enterprise Linux 6, GNU patch	NVD	Oct 22 11:17 UTC
CVE-2026-115207A flaw was found in GNU patch Executive summary A flaw in GNU patch lets an attacker create files in arbitrary locations on a system when a user or automated workflow applies a specially crafted patch file. The advisory rates it as a Red Hat CVSS v3.1 base score of 5.5 (Medium), and it states that no mitigation is currently available that meets Red Hat's criteria. Technical summary The weakness is classified as CWE-22 path traversal, caused by missing validation during automatic patch reversal that lets absolute file paths in patch headers be accepted. The attack is local (AV:L) with low complexity, requires no privileges, and needs user interaction, such as applying a crafted patch file. The advisory's CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. Affected and fixed versions are not stated in the text provided. No workarounds are given, and the advisory says mitigation is either not available or does not meet Red Hat's criteria. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-115207 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affects Red Hat GNU Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat Enterprise Linux 6 GNU patch NIST National Vulnerability DatabasePublished Oct 22, 2026 11:17 UTC Read the advisory
	High	7.4	CVE-2026-111079	A flaw was found in Goose Red Hat, GooseRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Goose	NVD	Oct 22 11:17 UTC
CVE-2026-111079A flaw was found in Goose Executive summary A flaw in Goose, an application with a terminal integration feature, can cause shell command history and environment data to be sent to configured large language model provider endpoints without sanitization. This can expose sensitive credentials such as API tokens and passwords to external providers and logs. Red Hat rates the impact as Important, and the advisory does not state a fixed version or specific vendor fix recommendation beyond its general guidance. Technical summary The weakness is classified as CWE-497, exposure of sensitive system information to an unauthorized control sphere. When the terminal integration feature is enabled, shell command history is captured and sent verbatim to configured LLM provider endpoints during queries. Exploitation requires user interaction to initialize the terminal integration subshell and run assistant queries, and the CVSS v3.1 base score is 7.4 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N as given by Red Hat and cve.org. Standard non-interactive command-line usage and sessions without the terminal integration hook are stated as not affected. The advisory does not state affected or fixed version numbers, workarounds beyond general mitigation guidance, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-111079 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Affects Red Hat Goose Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 9 Goose NIST National Vulnerability DatabasePublished Oct 22, 2026 11:17 UTC Read the advisory
	Medium	6.8	CVE-2026-114406	The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which... Red HatRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	NVD	Oct 21 21:17 UTC
CVE-2026-114406The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which... From the advisory The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions NIST National Vulnerability DatabasePublished Oct 21, 2026 21:17 UTC Read the advisory
	Medium	6.1	CVE-2026-85518	A flaw was found in OpenSCAP Red HatRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat Enterprise Linux 6	NVD	Oct 21 20:17 UTC
CVE-2026-85518A flaw was found in OpenSCAP From the advisory A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process. Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L Affects Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat Enterprise Linux 6 NIST National Vulnerability DatabasePublished Oct 21, 2026 20:17 UTC Read the advisory
	Medium	4.2	CVE-2026-114438	A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution Red HatRed Hat Build of Keycloak, Red Hat Single Sign-On 7	NVD	Oct 21 20:17 UTC
CVE-2026-114438A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution From the advisory A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affects Red Hat Red Hat Build of Keycloak Red Hat Single Sign-On 7 NIST National Vulnerability DatabasePublished Oct 21, 2026 20:17 UTC Read the advisory
	High	7.2	CVE-2026-110744	A flaw was found in multicluster-global-hub-operator-bundle Red HatRed Hat Multicluster Global Hub	NVD	Oct 21 18:17 UTC
CVE-2026-110744A flaw was found in multicluster-global-hub-operator-bundle From the advisory A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects Red Hat Red Hat Multicluster Global Hub NIST National Vulnerability DatabasePublished Oct 21, 2026 18:17 UTC Read the advisory
	Low	3.7	CVE-2026-114370	A flaw was found in the PathResourceManager component of the Undertow web server Red HatRed Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Single Sign-On 7, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Apache Camel for Spring Boot 4	NVD	Oct 21 16:17 UTC
CVE-2026-114370A flaw was found in the PathResourceManager component of the Undertow web server From the advisory A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Red Hat Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Single Sign-On 7 Red Hat Fuse 7 Red Hat JBoss Enterprise Application Platform 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Apache Camel for Spring Boot 4 NIST National Vulnerability DatabasePublished Oct 21, 2026 16:17 UTC Read the advisory
	Low	3.3	CVE-2026-114236	storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the... Red HatRed Hat Ansible Automation Platform 2, Red Hat Multicluster Engine for Kubernetes, Red Hat OpenShift Source-to-Image (S2I), Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Build of Podman Desktop, Red Hat Exploit Intelligence, Red Hat Advanced Cluster Security 4, Red Hat Confidential Compute Attestation, Red Hat DPU kit for NVIDIA, Red Hat NVIDIA JetPack 6 for RHEL, Red Hat OpenShift Lightspeed, Red Hat Developer Hub	NVD	Oct 21 09:17 UTC
CVE-2026-114236storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the... From the advisory storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affects Red Hat Red Hat Ansible Automation Platform 2 Red Hat Multicluster Engine for Kubernetes Red Hat OpenShift Source-to-Image (S2I)Red Hat Certification Program for Red Hat Enterprise Linux 9 Red Hat Build of Podman Desktop Red Hat Exploit Intelligence Red Hat Advanced Cluster Security 4 Red Hat Confidential Compute Attestation Red Hat DPU kit for NVIDIA Red Hat NVIDIA JetPack 6 for RHEL Red Hat OpenShift Lightspeed Red Hat Developer Hub NIST National Vulnerability DatabasePublished Oct 21, 2026 09:17 UTC Read the advisory
	Medium	6.5	CVE-2026-17557	A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI Red HatRed Hat OpenShift AI (RHOAI)	NVD	Oct 21 08:16 UTC
CVE-2026-17557A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI From the advisory A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Red Hat Red Hat OpenShift AI (RHOAI) NIST National Vulnerability DatabasePublished Oct 21, 2026 08:16 UTC Read the advisory
	Medium	6.2	CVE-2026-92824	A flaw was found in libmodulemd Red HatRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4	NVD	Oct 21 04:18 UTC
CVE-2026-92824A flaw was found in libmodulemd From the advisory A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat OpenShift Container Platform 4 NIST National Vulnerability DatabasePublished Oct 21, 2026 04:18 UTC Read the advisory
	Medium	6.2	CVE-2026-92823	A flaw was found in libmodulemd Red HatRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4	NVD	Oct 21 04:18 UTC
CVE-2026-92823A flaw was found in libmodulemd From the advisory A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat OpenShift Container Platform 4 NIST National Vulnerability DatabasePublished Oct 21, 2026 04:18 UTC Read the advisory
	Medium	6.2	CVE-2026-92822	A flaw was found in libmodulemd Red HatRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4	NVD	Oct 21 04:18 UTC
CVE-2026-92822A flaw was found in libmodulemd From the advisory A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Hardened Images Red Hat OpenShift Container Platform 4 NIST National Vulnerability DatabasePublished Oct 21, 2026 04:18 UTC Read the advisory
	Medium	5.1	CVE-2026-114038	A flaw was found in device-mapper-multipath Red HatRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4	NVD	Oct 21 01:17 UTC
CVE-2026-114038A flaw was found in device-mapper-multipath From the advisory A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS). Impact if exploited ConfidentialityLow IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L Affects Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 6 Red Hat OpenShift Container Platform 4 NIST National Vulnerability DatabasePublished Oct 21, 2026 01:17 UTC Read the advisory
	High	8.1	CVE-2026-105941	The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the... Red HatRed Hat streams for Apache Kafka 3	NVD	Oct 20 13:16 UTC
CVE-2026-105941The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the... From the advisory The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Affects Red Hat Red Hat streams for Apache Kafka 3 NIST National Vulnerability DatabasePublished Oct 20, 2026 13:16 UTC Read the advisory
	Medium	5.0	CVE-2026-113496	A flaw was found in cockpit-machines Red HatRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 9	NVD	Oct 20 12:17 UTC
CVE-2026-113496A flaw was found in cockpit-machines From the advisory A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the exposed password from the process list while another user modifies settings. This credential disclosure can allow unauthorized access to the guest virtual machine's graphical console. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Affects Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 9 NIST National Vulnerability DatabasePublished Oct 20, 2026 12:17 UTC Read the advisory
	Medium	5.0	CVE-2026-113495	A flaw was found in cockpit-machines Red HatRed Hat Enterprise Linux 10, Red Hat Enterprise Linux 9	NVD	Oct 20 12:17 UTC
CVE-2026-113495A flaw was found in cockpit-machines From the advisory A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view these arguments while the process is active. This flaw can lead to information disclosure, potentially allowing unauthorized access to RHSM resources within the token's validity period. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Affects Red Hat Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 9 NIST National Vulnerability DatabasePublished Oct 20, 2026 12:17 UTC Read the advisory
	High	8.8	CVE-2026-105949	Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling... Red HatRed Hat streams for Apache Kafka 2, Red Hat streams for Apache Kafka 3	NVD	Oct 20 12:17 UTC
CVE-2026-105949Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling... From the advisory Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips all leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication entirely but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat Red Hat streams for Apache Kafka 2 Red Hat streams for Apache Kafka 3 NIST National Vulnerability DatabasePublished Oct 20, 2026 12:17 UTC Read the advisory
	Critical	9.9	CVE-2026-105312	A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image Red HatRed Hat StreamsHub Console for Apache Kafka®, Red Hat streams for Apache Kafka 2, Red Hat streams for Apache Kafka 3	NVD	Oct 20 12:17 UTC
CVE-2026-105312A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image From the advisory A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L Affects Red Hat Red Hat StreamsHub Console for Apache Kafka®Red Hat streams for Apache Kafka 2 Red Hat streams for Apache Kafka 3 NIST National Vulnerability DatabasePublished Oct 20, 2026 12:17 UTC Read the advisory
	High	7.7	CVE-2026-105311	The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set... Red HatRed Hat StreamsHub Console for Apache Kafka®, Red Hat streams for Apache Kafka 2, Red Hat streams for Apache Kafka 3	NVD	Oct 20 12:17 UTC
CVE-2026-105311The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set... From the advisory The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Affects Red Hat Red Hat StreamsHub Console for Apache Kafka®Red Hat streams for Apache Kafka 2 Red Hat streams for Apache Kafka 3 NIST National Vulnerability DatabasePublished Oct 20, 2026 12:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited

Affects

From the advisory

Impact if exploited

How it is exploited