CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,477 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,477
Show in the list
Critical, last 7 days
360
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product redhat:enterprise_linux. Show all products

831 CVEs, showing 301 to 350PreviousPage 7 of 17Next
CVESeverityTitlePublished
CVE-2026-19546High 8.8Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute
Assigned by redhat
Aug 11, 2026
CVE-2026-71218Medium 5.3Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion
Assigned by redhat
Aug 11, 2026
CVE-2026-71217High 7.5Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion
Assigned by redhat
Aug 11, 2026
CVE-2026-72693High 7.8Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login
Assigned by redhat
Aug 11, 2026
CVE-2026-72694High 7.1Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
Assigned by redhat
Aug 11, 2026
CVE-2026-19391
Healthcare
Medium 6.5Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives
Assigned by redhat
Aug 11, 2026
CVE-2026-6426Medium 4.4Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
Assigned by redhat
Aug 10, 2026
CVE-2026-19411Low 3.9Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null
Assigned by redhat
Aug 10, 2026
CVE-2026-63622High 7.8Libvirt: swtpm privilege escalation via symlink following
Assigned by redhat
Aug 10, 2026
CVE-2026-59091High 7.3Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file
Assigned by redhat
Aug 10, 2026
CVE-2026-63623Medium 5.5Libvirt: information disclosure via world-readable storage volume images during clone/convert
Assigned by redhat
Aug 10, 2026
CVE-2026-59090High 8.4Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow
Assigned by redhat
Aug 10, 2026
CVE-2026-59088Medium 5.5Gimp: gimp: denial of service via signed integer overflow in fli file processing
Assigned by redhat
Aug 10, 2026
CVE-2026-59087High 7.8Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation
Assigned by redhat
Aug 10, 2026
CVE-2026-19404Medium 6.5389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance
Assigned by redhat
Aug 10, 2026
CVE-2026-19389High 7.1Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read
Assigned by redhat
Aug 10, 2026
CVE-2026-19387High 7.6Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
Assigned by redhat
Aug 10, 2026
CVE-2026-42170High 7.8Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)
Assigned by redhat
Aug 8, 2026
CVE-2026-61477Low 2.3Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
Assigned by redhat
Aug 7, 2026
CVE-2026-15816High 7.5Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
Assigned by redhat
Aug 7, 2026
CVE-2026-18938Medium 6.2P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems
Assigned by redhat
Aug 7, 2026
CVE-2026-19079Medium 4.4Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation
Assigned by redhat
Aug 7, 2026
CVE-2026-7867High 7.8Udisks2: udisks2: local privilege escalation via as-user option spoofing
Assigned by redhat
Aug 6, 2026
CVE-2026-18649High 7.5Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders
Assigned by redhat
Aug 6, 2026
CVE-2026-18839Low 2.2Popt-devel: popt-static: size_t underflow in singleoptionhelp
Assigned by redhat
Aug 5, 2026
CVE-2026-44605Medium 5.5Rpm: heap buffer overflow in ndb slot table parsing
Assigned by redhat
Aug 5, 2026
CVE-2026-71227Medium 5.1Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return
Assigned by redhat
Aug 5, 2026
CVE-2026-71226High 7.3Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path
Assigned by redhat
Aug 5, 2026
CVE-2026-71225Medium 6.5Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries
Assigned by redhat
Aug 5, 2026
CVE-2026-18103Medium 4.9Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi
Assigned by redhat
Aug 4, 2026
CVE-2026-68743Medium 5.5Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1
Assigned by redhat
Aug 4, 2026
CVE-2026-70368Medium 6.5Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message
Assigned by redhat
Aug 4, 2026
CVE-2026-70367Medium 5.4Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services
Assigned by redhat
Aug 4, 2026
CVE-2026-18739Low 2.5Popt-devel: popt-static: off-by-one in poptstuffargs
Assigned by redhat
Aug 4, 2026
CVE-2026-68744Low 3.3Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply
Assigned by redhat
Aug 4, 2026
CVE-2026-42169High 7.3Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)
Assigned by redhat
Aug 4, 2026
CVE-2026-18477Medium 4.4Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape
Assigned by redhat
Aug 3, 2026
CVE-2026-18651Medium 5.4389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account
Assigned by redhat
Aug 3, 2026
CVE-2026-18508Medium 4.4Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
Assigned by redhat
Aug 3, 2026
CVE-2026-68742Medium 5.5Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr
Assigned by redhat
Aug 3, 2026
CVE-2026-6695Medium 5.5Gimp: gimp: remote code execution via crafted paa file
Assigned by redhat
Aug 3, 2026
CVE-2026-6694Medium 5.5Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk
Assigned by redhat
Aug 3, 2026
CVE-2026-18358High 7.5Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service
Assigned by redhat
Jul 31, 2026
CVE-2026-11770High 7.5389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check
Assigned by redhat
Jul 31, 2026
CVE-2026-15722High 7.5389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing
Assigned by redhat
Jul 31, 2026
CVE-2026-18157High 7.8Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection
Assigned by redhat
Jul 31, 2026
CVE-2026-68563Medium 5.5Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions
Assigned by redhat
Jul 30, 2026
CVE-2026-68562Medium 6.2Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering
Assigned by redhat
Jul 30, 2026
CVE-2026-58216Medium 5.3Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash
Assigned by redhat
Jul 30, 2026
CVE-2026-58222High 8.8Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes
Assigned by redhat
Jul 30, 2026
PreviousPage 7 of 17Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.