Red Hat Security AdvisoryRHSA-2026:94802
A Subscription Management tool for finding and reporting Red Hat product usage
Released 2026-11-04 · Red Hat rating Critical · View on Red Hat →
Fixes 19 records
Priority CRITICAL 99KEV
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, dis…
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.82641 · Published 2026-10-22 · Partial fix · 1.0.10, 1.1.1 +2 CWE-252
Priority HIGH 72
Django REST framework is a toolkit for building Web APIs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00595 · Published 2026-10-21 · Partial fix · 3.18.2 CWE-400
Priority HIGH 72
Django REST framework is a toolkit for building Web APIs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00503 · Published 2026-10-21 · Partial fix · 3.18.2 CWE-409
Priority HIGH 72
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00396 · Published 2026-07-03 · Partial fix · 8.14.2, 8.16.1 +1 CWE-305
Priority HIGH 70
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+.
CVSS 4.0HIGH 8.4· Network · Low privileges · No interaction · EPSS 0.00312 · Published 2026-10-28 · Partial fix · 4.0.0 CWE-863
Priority MEDIUM 42
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c.
CVSS 4.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.0032 · Published 2026-10-07 · Partial fix CWE-125
Priority MEDIUM 40
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server nam…
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00524 · Published 2026-09-30 · Partial fix · 3.10.22, 3.11.17 +4 CWE-416
Priority LOW 38
urllib3 is an HTTP client library for Python.
CVSS 4.0HIGH 8.9· Network · No auth · No interaction · EPSS 0.00335 · Published 2026-09-29 · Partial fix · 2.8.0 CWE-770
Priority LOW 36
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00368 · Published 2026-09-29 · Partial fix CWE-190
Priority LOW 36
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.
CVSS 4.0HIGH 7.6· Network · No auth · User interaction · EPSS 0.00547 · Published 2026-09-30 · Partial fix · 3.10.22, 3.11.17 +4 CWE-297
Priority LOW 35
Django REST framework is a toolkit for building Web APIs.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00512 · Published 2026-10-21 · Partial fix · 3.18.2 CWE-390
Priority LOW 35
urllib3 is an HTTP client library for Python.
CVSS 4.0HIGH 7.6· Network · No auth · User interaction · EPSS 0.00206 · Published 2026-09-29 · Partial fix · 2.8.0 CWE-295
Priority LOW 34
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.00202 · Published 2026-09-21 · Partial fix · 1.8.14 CWE-122
Priority LOW 34
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00618 · Published 2026-07-08 · Partial fix · 10.4 CWE-770
Priority LOW 32
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak pr…
CVSS 3.1MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.0031 · Published 2026-10-21 · Partial fix · 2026.2.92_v9.0.319-100.3.el10_2, 2026.2.92_v9.0.319-100.3.el10_0 +138 CWE-295
Priority LOW 28
sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.0018 · Published 2026-07-08 · Partial fix · 10.4 CWE-573
Priority LOW 26
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition.
CVSS 4.0MEDIUM 5.9· Local · No auth · No interaction · EPSS 0.00344 · Published 2026-09-29 · Partial fix · 3.12.15, 3.13.18 +2 CWE-59
Priority LOW 24
internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an…
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00175 · Published 2026-07-08 · Partial fix · 10.4 CWE-1284
Priority LOW 16
XZ Utils provide a general-purpose data-compression library plus command-line tools.
CVSS 4.0LOW 1.7· Network · No auth · No interaction · EPSS 0.00534 · Published 2026-04-02 · Partial fix · 5.8.3 CWE-122
THREATIST.IORead the docs