Red Hat

Records7413All Threatist records

Exploited (KEV)98In CISA KEV

CVSS critical792CVSS 9.0–10.0

CVSS high2681CVSS 7.0–8.9

Exploited now

Red Hat records in CISA KEV

TI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability CRITICAL 93KEV 2026-10-28 TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability CRITICAL 86KEV 2026-09-02 TI-2015-02874 Red Hat Libuser Race Condition Vulnerability CRITICAL 92KEV 2026-08-26 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04

Components

Products in the NVD configurations · select one to filter the records

Enterprise Linux 1956 records CRITICAL Enterprise Linux Desktop 1928 records CRITICAL Enterprise Linux Server 1891 records CRITICAL Enterprise Linux Workstation 1845 records CRITICAL Enterprise Linux Server Aus 1061 records CRITICAL Enterprise Linux Eus 796 records CRITICAL Enterprise Linux Server Tus 770 records CRITICAL Enterprise Linux Server Eus 622 records CRITICAL

Records

12 records in Openshift Virtualization · all components

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400

TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…

HIGH 70

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.93547 Published 2023-12-18 Partial fix · 0.40.2, 0.17.0 +2 CWE-354

TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00854 Published 2026-06-11 Partial fix · 1.15.2, 0.31.1 CWE-1321

TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

MEDIUM 46

Immutable.js provides many Persistent Immutable data structures.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0099 Published 2026-03-06 Partial fix · 3.8.3, 4.3.7 +2 CWE-1321

TI-2020-11187 CVE-2020-14316 · GHSA-828r-r2c8-rfw3

Improper privilege management in kubevirt

MEDIUM 46

A flaw was found in kubevirt 0.29 and earlier.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01576 Published 2020-07-29 Partial fix · 0.30.0 CWE-269

TI-2026-11209 CVE-2026-13201 · GHSA-rcfc-7m3g-h5xh

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler…

LOW 32

A flaw was found in KubeVirt's safepath package used by virt-handler.

CVSS 3.1HIGH 7.3 Local Low privileges No interaction EPSS 0.00308 Published 2026-06-24 Fixed in 1791522624, 1786346596 +9 CWE-61

TI-2020-01686 CVE-2020-1742

Incorrect permission assignment in nmstate/kubernetes-nmstate-handler

LOW 30

An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00256 Published 2021-06-07 Fixed CWE-266

TI-2026-11284 CVE-2026-13318 · GHSA-cgm6-wvp9-4g5h

Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip

LOW 28

A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00236 Published 2026-06-25 Partial fix · 1.10.0-rc.0 CWE-918

TI-2026-11215 CVE-2026-13208 · GHSA-72r2-m3hg-cvf5

Improper authentication in Red Hat OpenShift Virtualization 4

LOW 28

A flaw was found in KubeVirt's virt-handler domain notify server.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00126 Published 2026-06-24 Fix deferred CWE-287

TI-2026-11369 CVE-2026-13434 · GHSA-9fjc-whw6-cqfc

Improper input validation in Red Hat OpenShift Virtualization 4

LOW 22

A flaw was found in KubeVirt's network annotation generator.

CVSS 3.1MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00244 Published 2026-06-26 Fix deferred CWE-20

TI-2026-11224 CVE-2026-13218 · GHSA-q3jc-42cq-33fj

Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher

LOW 19

A flaw was found in KubeVirt's virt-handler network cache handling.

CVSS 3.1MEDIUM 4.2 Local Low privileges No interaction EPSS 0.00139 Published 2026-06-25 Fix deferred CWE-61

TI-2026-11287 CVE-2026-13322 · GHSA-6f2p-2qg2-qqch

Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service

LOW 17

A flaw was found in KubeVirt's downward metrics virtio-serial server.

CVSS 3.1LOW 3.8 Local Low privileges No interaction EPSS 0.00134 Published 2026-06-26 Fix deferred CWE-770

Open these records in search →

Critical	792
High	2681
Medium	3429
Low	509
No CVSS	2