CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,436 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,436
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product redhat:enterprise_linux_eus. Show all products

195 CVEs, showing 1 to 50Page 1 of 4Next
CVESeverityTitlePublished
CVE-2026-18147High 8.1Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
Assigned by redhat
Sep 9, 2026
CVE-2026-18922Critical 9.8389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property
Assigned by redhat
Sep 7, 2026
CVE-2026-18453High 7.5389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search
Assigned by redhat
Sep 7, 2026
CVE-2026-18355High 7.5389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()
Assigned by redhat
Sep 7, 2026
CVE-2026-76560High 7.5389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn
Assigned by redhat
Sep 7, 2026
CVE-2026-79678High 8.1Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
Assigned by redhat
Sep 7, 2026
CVE-2026-76578Critical 9.8Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
Assigned by redhat
Sep 7, 2026
CVE-2026-81665High 7.5Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
Assigned by redhat
Sep 4, 2026
CVE-2026-85197High 7.6Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
Assigned by redhat
Sep 4, 2026
CVE-2026-78002High 7.5Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
Assigned by redhat
Aug 27, 2026
CVE-2026-11861Critical 9.6Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships
Assigned by redhat
Aug 20, 2026
CVE-2026-73198High 7.5Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read
Assigned by redhat
Aug 20, 2026
CVE-2026-13097High 8.7Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore
Assigned by redhat
Aug 20, 2026
CVE-2026-73197High 7.5Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
Assigned by redhat
Aug 20, 2026
CVE-2026-18917High 7.8Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
Assigned by redhat
Aug 20, 2026
CVE-2026-19654High 7.5Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd
Assigned by redhat
Aug 12, 2026
CVE-2026-73433Medium 6.6Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write
Assigned by redhat
Aug 12, 2026
CVE-2026-73434Medium 6.1Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing
Assigned by redhat
Aug 12, 2026
CVE-2026-19550High 8.2Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes
Assigned by redhat
Aug 11, 2026
CVE-2026-63622High 7.8Libvirt: swtpm privilege escalation via symlink following
Assigned by redhat
Aug 10, 2026
CVE-2026-19389High 7.1Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read
Assigned by redhat
Aug 10, 2026
CVE-2026-19387High 7.6Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
Assigned by redhat
Aug 10, 2026
CVE-2026-15816High 7.5Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
Assigned by redhat
Aug 7, 2026
CVE-2026-7867High 7.8Udisks2: udisks2: local privilege escalation via as-user option spoofing
Assigned by redhat
Aug 6, 2026
CVE-2026-42169High 7.3Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)
Assigned by redhat
Aug 4, 2026
CVE-2026-11770High 7.5389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check
Assigned by redhat
Jul 31, 2026
CVE-2026-15722High 7.5389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing
Assigned by redhat
Jul 31, 2026
CVE-2026-16524High 7.8Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection
Assigned by redhat
Jul 30, 2026
CVE-2026-16313High 7.6Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
Assigned by redhat
Jul 28, 2026
CVE-2026-15588Medium 5.3Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering
Assigned by redhat
Jul 20, 2026
CVE-2026-16118High 7.1Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c
Assigned by redhat
Jul 17, 2026
CVE-2026-14476High 8.0Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass
Assigned by redhat
Jul 7, 2026
CVE-2026-14474High 8.8Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
Assigned by redhat
Jul 7, 2026
CVE-2026-58016High 7.5Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"
Assigned by redhat
Jun 30, 2026
CVE-2026-58015Medium 5.9Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
Assigned by redhat
Jun 30, 2026
CVE-2026-58014High 7.3Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"
Assigned by redhat
Jun 30, 2026
CVE-2026-58013Medium 6.5Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
Assigned by redhat
Jun 30, 2026
CVE-2026-58012Medium 6.5Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()
Assigned by redhat
Jun 30, 2026
CVE-2026-58011Medium 6.5Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime
Assigned by redhat
Jun 30, 2026
CVE-2026-58010Medium 6.5Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()
Assigned by redhat
Jun 30, 2026
CVE-2026-14164High 7.5Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()
Assigned by redhat
Jun 30, 2026
CVE-2026-12912High 7.3Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image
Assigned by redhat
Jun 29, 2026
CVE-2026-53016High 7.8crypto: ccp - copy IV using skcipher ivsize
Assigned by Linux
Jun 24, 2026
CVE-2026-53006Critical 9.8ipv6: fix possible UAF in icmpv6_rcv()
Assigned by Linux
Jun 24, 2026
CVE-2026-53000High 7.8netfilter: nat: use kfree_rcu to release ops
Assigned by Linux
Jun 24, 2026
CVE-2026-52923High 7.8ipc: limit next_id allocation to the valid ID range
Assigned by Linux
Jun 24, 2026
CVE-2026-55655Medium 5.0Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions
Assigned by redhat
Jun 23, 2026
CVE-2026-55653Medium 4.3Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service
Assigned by redhat
Jun 23, 2026
CVE-2026-56208High 7.6Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
Assigned by redhat
Jun 19, 2026
CVE-2026-46331High 7.8net/sched: fix pedit partial COW leading to page cache corruption
Assigned by Linux
Jun 16, 2026
Page 1 of 4Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.