Vendor
Red Hat
2,743 known vulnerabilities in products by Red Hat, 3 of them actively exploited (CISA KEV).
Key figures
2,743
Vulnerabilities
3
Actively exploited (KEV)
0
Used by ransomware
170
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2023-4911 | Glibc: buffer overflow in ld.so leading to privilege escalation In CISA KEV | 7.8 | |
| Critical | CVE-2022-34265 | Django: SQL Injection | 9.8 | |
| Critical | CVE-2007-4559 | Python Software Foundation CPython: Path Traversal | 9.8 | |
| Critical | CVE-2026-4631 | Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection | 9.8 | |
| Critical | CVE-2024-5535 | SSL_select_next_proto buffer overread | 9.1 | |
| High | CVE-2025-3155 | Yelp: arbitrary file read | 7.4 | |
| Critical | CVE-2026-18963 | Red Hat: Weak Password Recovery Mechanism for Forgotten Password | 9.1 | |
| Critical | CVE-2025-10230 | Samba: command injection in wins server hook script | 10.0 | |
| Critical | CVE-2026-4480 | Samba: samba: remote code execution in printing subsystem via unescaped job description | 9.0 | |
| High | CVE-2023-24580 | Django: Denial of Service | 7.5 | |
| High | CVE-2023-23969 | Django: Denial of Service | 7.5 | |
| Critical | CVE-2024-12084 | Rsync: heap buffer overflow in rsync due to improper checksum length handling | 9.8 | |
| Critical | CVE-2024-3094 | Xz: malicious code in distributed source | 10.0 | |
| Medium | CVE-2024-2511 | Unbounded memory growth with session handling in TLSv1.3 | 5.9 | |
| Critical | CVE-2024-45337 | Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto | 9.1 | |
| Critical | CVE-2022-24724 | Integer overflow in table parsing extension leads to heap memory corruption | 8.8 | |
| Critical | CVE-2026-1709 | Red Hat Enterprise Linux 10: Key Exchange without Entity Authentication | 9.4 | |
| High | CVE-2026-6893 | Dracut: dracut: root code execution via dhcp options command injection | 7.5 | |
| High | CVE-2026-8632 | HP Linux Imaging and Printing Software: Command Injection | 7.8 | |
| High | CVE-2026-40217 | BerriAI LiteLLM: Unprotected Alternate Channel | 8.8 | |
| Critical | CVE-2026-42945 | NGINX ngx_http_rewrite_module vulnerability | 8.1 | |
| High | CVE-2026-58459 | gpsd gpsprof Command Injection via gnuplot plot title subtype field | 7.8 | |
| High | CVE-2023-46847 | Squid: denial of service in http digest authentication | 8.6 |
News
- F5 rushes out emergency NGINX patches for three critical flawscsoonline,
- NCSC-2026-0423 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Windowsncsc-nl,
- NCSC-2026-0377 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Enterprise Managerncsc-nl,
- September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windowscsoonline,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,
- NCSC-2026-0326 [1.00] [M/H] Kwetsbaarheden verholpen in Keycloakncsc-nl,