Red Hat

Records7413All Threatist records

Exploited (KEV)98In CISA KEV

CVSS critical792CVSS 9.0–10.0

CVSS high2681CVSS 7.0–8.9

Exploited now

Red Hat records in CISA KEV

TI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability CRITICAL 93KEV 2026-10-28 TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability CRITICAL 86KEV 2026-09-02 TI-2015-02874 Red Hat Libuser Race Condition Vulnerability CRITICAL 92KEV 2026-08-26 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04

Components

Products in the NVD configurations · select one to filter the records

Enterprise Linux 1956 records CRITICAL Enterprise Linux Desktop 1928 records CRITICAL Enterprise Linux Server 1891 records CRITICAL Enterprise Linux Workstation 1845 records CRITICAL Enterprise Linux Server Aus 1061 records CRITICAL Enterprise Linux Eus 796 records CRITICAL Enterprise Linux Server Tus 770 records CRITICAL Enterprise Linux Server Eus 622 records CRITICAL

Records

10 records in Icedtea-web · all components

TI-2012-02952 CVE-2012-3423 · GHSA-wg7g-m9g6-qcmw

The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without…

MEDIUM 42

The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive information from memory, or e…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.06172 Published 2012-08-07 Fixed CWE-119

TI-2011-00614 CVE-2011-0706 · GHSA-6228-hc88-4m3g

The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime…

LOW 38

The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of "an in…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03086 Published 2011-02-18 No fix listed CWE-264

TI-2013-01703 CVE-2013-1927 · GHSA-h9w9-hgh2-mwrp

The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to…

LOW 37

The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.04323 Published 2013-04-29 Fixed

TI-2012-03880 CVE-2012-4540 · GHSA-44v2-cg42-mx34

Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in…

LOW 36

Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive in…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0344 Published 2012-11-11 Fixed CWE-189

TI-2012-02951 CVE-2012-3422 · GHSA-qwm3-gpj3-x6c9

The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an…

LOW 36

The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial of service (crash) a…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.03119 Published 2012-08-07 Fixed CWE-119

TI-2011-02206 CVE-2011-2514 · GHSA-mfx6-3x7c-57wf

The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9…

LOW 35

The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting acces…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02397 Published 2014-05-14 Fixed CWE-264

TI-2013-01702 CVE-2013-1926 · GHSA-vwgw-5wg9-mw8j

The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for…

LOW 30

The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or p…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01865 Published 2013-04-29 Fixed

TI-2011-02205 CVE-2011-2513 · GHSA-pphc-5pp2-xfm2

The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9…

LOW 28

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02497 Published 2014-05-14 Fixed CWE-200

TI-2011-02987 CVE-2011-3377 · GHSA-cqp6-h2hr-w9xj

The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows…

LOW 24

The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02217 Published 2014-02-05 Fixed CWE-264

TI-2013-05442 CVE-2013-6493 · GHSA-5rjx-hhcc-fqph

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web…

LOW 12

The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file wi…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00478 Published 2014-03-03 Fixed CWE-200

Open these records in search →

Critical	792
High	2681
Medium	3429
Low	509
No CVSS	2