Known vulnerabilities in Red Hat Enterprise Linux 10

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-53683	Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html	4.3 Medium	Sep 2, 2026
CVE-2026-84270	Gvfs: mtp: out-of-bounds read in do_read()	4.3 Medium	Sep 1, 2026
CVE-2026-84269	Gvfs: afp: heap-based buffer overflow in dsi read path	6.5 Medium	Sep 1, 2026
CVE-2026-84267	Gvfs: sftp: uninitialized heap disclosure in read_string()	4.3 Medium	Sep 1, 2026
CVE-2026-84268	Gvfs: sftp: heap-based buffer overflow in read_reply()	8.8 High	Sep 1, 2026
CVE-2026-84233	Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames	7.0 High	Sep 1, 2026
CVE-2026-53682	Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts	5.3 Medium	Sep 1, 2026
CVE-2026-11873	Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure	6.5 Medium	Sep 1, 2026
CVE-2026-18743	Popt-devel: popt-static: short realloc in poptconfigfiletostring	2.5 Low	Sep 1, 2026
CVE-2026-13732	Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf	7.0 High	Aug 31, 2026
CVE-2026-81624	Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite	7.5 High	Aug 31, 2026
CVE-2026-82327	Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data	5.5 Medium	Aug 28, 2026
CVE-2026-80179	Jwcrypto: jwcrypto: denial of service via malformed jwe tokens	5.9 Medium	Aug 27, 2026
CVE-2026-81893	Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery	4.7 Medium	Aug 27, 2026
CVE-2026-5680	Undertow-core: undertow: denial of service via websocket permessage-deflate processing	7.5 High	Aug 27, 2026
CVE-2026-78002	Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function	7.5 High	Aug 27, 2026
CVE-2026-80185	Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root	5.7 Medium	Aug 25, 2026
CVE-2026-80186	Bluez: stack overflow in name2utf8 causes dos and potential code execution	7.6 High	Aug 25, 2026
CVE-2026-77680	Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix	5.3 Medium	Aug 25, 2026
CVE-2026-79992	Emacs: emacs: command injection via crafted filenames in tramp	7.8 High	Aug 25, 2026
CVE-2026-79655	Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write	7.8 High	Aug 25, 2026
CVE-2026-78701	389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos	6.5 Medium	Aug 25, 2026
CVE-2026-19685	Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)	7.1 High	Aug 24, 2026
CVE-2026-78367	Rpm: rpmbuild gettarspec() crafted tar member name → macro injection	7.0 High	Aug 24, 2026
CVE-2026-78323	Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates	6.5 Medium	Aug 24, 2026

Other Red Hat products