Vulnerabilities of Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-114406	Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns	6.8 Medium	Oct 21, 2026
CVE-2026-102559	Libsoup: libsoup: heap buffer overflow during websocket client-frame masking	8.6 High	Sep 29, 2026
CVE-2026-102558	Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth	8.6 High	Sep 29, 2026
CVE-2026-102557	Libsoup: libsoup: heap buffer overflow during websocket message reassembly	8.6 High	Sep 29, 2026
CVE-2026-102556	Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion	8.6 High	Sep 29, 2026
CVE-2026-96889	Librsvg: use-after-free when xml includes have duplicated entities	7.8 High	Sep 23, 2026
CVE-2026-96275	Flatpak: flatpak: arbitrary write access as root via extra-data extraction	8.8 High	Sep 23, 2026
CVE-2026-96512	A flaw was found in sudo	7.8 High	Sep 23, 2026
CVE-2026-86320	A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true	7.8 High	Sep 17, 2026
CVE-2026-18147	Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url	8.1 High	Sep 9, 2026
CVE-2026-87766	A flaw was found in bubblewrap	8.8 High	Sep 9, 2026
CVE-2026-74860	Libxml2: double-free/uaf in libxml2 python bindings	8.5 High	Sep 8, 2026
CVE-2026-76561	Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)	7.2 High	Sep 8, 2026
CVE-2026-18922	A flaw was found in 389 Directory Server	9.8 Critical	Sep 7, 2026
CVE-2026-18453	389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search	7.5 High	Sep 7, 2026
CVE-2026-18355	389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()	7.5 High	Sep 7, 2026
CVE-2026-76560	389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn	7.5 High	Sep 7, 2026
CVE-2026-79678	Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service	8.1 High	Sep 7, 2026
CVE-2026-76578	Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci	9.8 Critical	Sep 7, 2026
CVE-2026-81665	A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly	7.5 High	Sep 4, 2026
CVE-2026-84268	Gvfs: sftp: heap-based buffer overflow in read_reply()	8.8 High	Sep 1, 2026
CVE-2026-83596	Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature	8.8 High	Aug 31, 2026
CVE-2026-78002	Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function	7.5 High	Aug 27, 2026
CVE-2026-78376	Webkitgtk: use-after-free of jscvalue function parameters	8.8 High	Aug 24, 2026
CVE-2026-11861	Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships	9.6 Critical	Aug 20, 2026

Other Red Hat products