Red Hat Security AdvisoryRHSA-2026:46836
A Subscription Management tool for finding and reporting Red Hat product usage
Released 2026-07-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
Fixes 13 records
Priority HIGH 82
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one by…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00502 · Published 2026-04-20 · Partial fix CWE-122
Priority HIGH 72
Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, ma…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00369 · Published 2026-04-20 · Partial fix CWE-127
Priority MEDIUM 51
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.06537 · Published 2026-06-17 · Fixed in 1.31.2, 1.30.3 +2 CWE-122
Priority MEDIUM 46
A flaw was found in GLib.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0056 · Published 2026-06-30 · Partial fix · 2.89.0, 2.80.4-12.el10_2.14 +52 CWE-191
Priority MEDIUM 45
The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00637 · Published 2026-07-09 · Partial fix · 3.10.21, 3.11.16 +4 CWE-400
Priority LOW 38
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG rec…
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00237 · Published 2026-04-28 · Partial fix CWE-787
Priority LOW 37
acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to esc…
CVSS 4.0HIGH 8.4· Local · Low privileges · No interaction · EPSS 0.00153 · Published 2026-06-29 · Partial fix · 2.4.0 CWE-59
Priority LOW 35
A flaw was found in libsolv.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00227 · Published 2026-05-26 · Fixed in 0.7.33-5.el10_2, 0.7.29-8.el10_0.1 +60 CWE-787
Priority LOW 35
A flaw was found in ansible-core.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00222 · Published 2026-06-05 · Partial fix · 1:2.16.19-1.el8ap, 1:2.16.19-1.el9ap +33 CWE-88
Priority LOW 35
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LO…
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00358 · Published 2026-04-28 · Fixed CWE-126
Priority LOW 32
acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an…
CVSS 4.0HIGH 7.2· Local · Low privileges · No interaction · EPSS 0.00088 · Published 2026-06-29 · Partial fix · 2.4.0 CWE-367
Priority LOW 20
A flaw was found in GNU Coreutils.
CVSS 3.1MEDIUM 4.4· Local · No auth · User interaction · EPSS 0.0031 · Published 2025-05-27 · Partial fix · 9.8, 9.5-8.el10_2 +33 CWE-121
Priority LOW 13
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.
CVSS 3.1LOW 2.5· Local · No auth · User interaction · EPSS 0.00323 · Published 2025-06-16 · Partial fix · 2.14.5, 2.12.5-10.el10_2.2 +89 CWE-121
THREATIST.IORead the docs