CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,469 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,469
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product redhat:rhel_eus. Show all products

183 CVEs, showing 151 to 183PreviousPage 4 of 4
CVESeverityTitlePublished
CVE-2026-66758High 7.8Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images
Assigned by redhat
Jul 27, 2026
CVE-2026-16313High 7.6Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
Assigned by redhat
Jul 28, 2026
CVE-2026-16524High 7.8Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection
Assigned by redhat
Jul 30, 2026
CVE-2026-15722High 7.5389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing
Assigned by redhat
Jul 31, 2026
CVE-2026-11770High 7.5389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check
Assigned by redhat
Jul 31, 2026
CVE-2026-42169High 7.3Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)
Assigned by redhat
Aug 4, 2026
CVE-2026-18649High 7.5Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders
Assigned by redhat
Aug 6, 2026
CVE-2026-15816High 7.5Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
Assigned by redhat
Aug 7, 2026
CVE-2026-19387High 7.6Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
Assigned by redhat
Aug 10, 2026
CVE-2026-19389High 7.1Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read
Assigned by redhat
Aug 10, 2026
CVE-2026-59090High 8.4Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow
Assigned by redhat
Aug 10, 2026
CVE-2026-63622High 7.8Libvirt: swtpm privilege escalation via symlink following
Assigned by redhat
Aug 10, 2026
CVE-2026-19550High 8.2Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes
Assigned by redhat
Aug 11, 2026
CVE-2026-73434Medium 6.1Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing
Assigned by redhat
Aug 12, 2026
CVE-2026-73433Medium 6.6Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write
Assigned by redhat
Aug 12, 2026
CVE-2026-19654High 7.5Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd
Assigned by redhat
Aug 12, 2026
CVE-2026-18917High 7.8Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
Assigned by redhat
Aug 20, 2026
CVE-2026-73197High 7.5Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
Assigned by redhat
Aug 20, 2026
CVE-2026-13097High 8.7Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore
Assigned by redhat
Aug 20, 2026
CVE-2026-73198High 7.5Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read
Assigned by redhat
Aug 20, 2026
CVE-2026-11861Critical 9.6Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
Assigned by redhat
Aug 20, 2026
CVE-2026-78002High 7.5Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
Assigned by redhat
Aug 27, 2026
CVE-2026-17615High 7.5Resteasy-core: resteasy sourceprovider remote unauthenticated file read
Assigned by redhat
Aug 31, 2026
CVE-2026-81665High 7.5Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
Assigned by redhat
Sep 4, 2026
CVE-2026-76578Critical 9.8Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
Assigned by redhat
Sep 7, 2026
CVE-2026-79678High 8.1Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
Assigned by redhat
Sep 7, 2026
CVE-2026-76560High 7.5389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn
Assigned by redhat
Sep 7, 2026
CVE-2026-18355High 7.5389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()
Assigned by redhat
Sep 7, 2026
CVE-2026-18453High 7.5389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search
Assigned by redhat
Sep 7, 2026
CVE-2026-18922Critical 9.8389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property
Assigned by redhat
Sep 7, 2026
CVE-2026-18147High 8.1Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
Assigned by redhat
Sep 9, 2026
CVE-2026-75092High 7.3Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins
Assigned by redhat
Sep 15, 2026
CVE-2026-92925High 7.1Redis: redis: out-of-bounds read via crafted cluster bus packets
Assigned by redhat
Sep 17, 2026
PreviousPage 4 of 4

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.