Known vulnerabilities in Red Hat Enterprise Linux 8

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-79705	Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers	4.5 Medium	Sep 15, 2026
CVE-2026-85013	Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters	7.3 High	Sep 15, 2026
CVE-2026-91926	Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm_decode_target_info via duplicated av_pair entries in ntlm challenge	3.7 Low	Sep 15, 2026
CVE-2026-91786	Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size	6.1 Medium	Sep 15, 2026
CVE-2026-75092	Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins	7.3 High	Sep 15, 2026
CVE-2026-19816	A flaw was found in PackageKit	7.1 High	Sep 14, 2026
CVE-2026-90996	Sssd: sssd: denial of service in nss responder via crafted zero-length requests	4.0 Medium	Sep 14, 2026
CVE-2026-90995	Sssd: sssd: local denial of service due to null pointer dereference in pam responder	5.5 Medium	Sep 14, 2026
CVE-2026-90994	Sssd: sssd: denial of service via malformed pam v1 requests	4.0 Medium	Sep 14, 2026
CVE-2026-90463	Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)	4.0 Medium	Sep 14, 2026
CVE-2026-90947	Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file	7.8 High	Sep 14, 2026
CVE-2026-90949	Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch	7.8 High	Sep 14, 2026
CVE-2026-90948	Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions	7.8 High	Sep 14, 2026
CVE-2026-89329	Device-mapper-multipath: local denial of service via blocking ipc send operations	6.2 Medium	Sep 11, 2026
CVE-2026-18495	Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough	6.1 Medium	Sep 11, 2026
CVE-2026-77159	Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink	5.5 Medium	Sep 11, 2026
CVE-2026-88914	Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser	4.4 Medium	Sep 11, 2026
CVE-2026-88924	Gvfs: gvfs-admin socket ownership race permits local root	7.0 High	Sep 10, 2026
CVE-2026-88859	Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction	6.3 Medium	Sep 10, 2026
CVE-2026-84828	Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token	6.5 Medium	Sep 10, 2026
CVE-2026-88265	Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown	5.6 Medium	Sep 10, 2026
CVE-2026-88264	Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs	5.6 Medium	Sep 10, 2026
CVE-2026-84042	Crun: crun: rootful krun with passt executes container payload as host root	7.8 High	Sep 10, 2026
CVE-2026-18147	Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url	8.1 High	Sep 9, 2026
CVE-2026-87876	Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)	3.0 Low	Sep 9, 2026

Other Red Hat products