Red Hat

Records7413All Threatist records

Exploited (KEV)98In CISA KEV

CVSS critical792CVSS 9.0–10.0

CVSS high2681CVSS 7.0–8.9

Exploited now

Red Hat records in CISA KEV

TI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability CRITICAL 93KEV 2026-10-28 TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability CRITICAL 86KEV 2026-09-02 TI-2015-02874 Red Hat Libuser Race Condition Vulnerability CRITICAL 92KEV 2026-08-26 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04

Components

Products in the NVD configurations · select one to filter the records

Enterprise Linux 1956 records CRITICAL Enterprise Linux Desktop 1928 records CRITICAL Enterprise Linux Server 1891 records CRITICAL Enterprise Linux Workstation 1845 records CRITICAL Enterprise Linux Server Aus 1061 records CRITICAL Enterprise Linux Eus 796 records CRITICAL Enterprise Linux Server Tus 770 records CRITICAL Enterprise Linux Server Eus 622 records CRITICAL

Records

10 records in Ovirt-engine · all components

TI-2017-05153 CVE-2017-7510 · GHSA-4mqp-w6v5-gr6x

Information disclosure in [UNKNOWN] RHV

MEDIUM 40

In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01017 Published 2019-03-25 Fixed CWE-200

TI-2014-06524 CVE-2014-7851 · GHSA-353g-73mj-6wf9

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the…

LOW 35

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by re…

CVSS 3.0HIGH 7.5 Network Low privileges No interaction EPSS 0.01002 Published 2017-10-16 Fixed CWE-264

TI-2014-00146 CVE-2014-0152 · GHSA-73j8-g9r9-3463

Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier…

LOW 34

Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01757 Published 2014-09-08 Fixed

TI-2016-02611 CVE-2016-3113 · GHSA-rw95-q62j-65gp

Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.

LOW 32

Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0274 Published 2017-08-07 Will not fix CWE-79

TI-2016-02576 CVE-2016-3077 · GHSA-3qjp-m28w-prvg

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote…

LOW 31

The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00998 Published 2017-06-06 Fixed CWE-119

TI-2015-01598 CVE-2015-1780 · GHSA-3jvc-mp84-rcxx

oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center

LOW 31

oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01036 Published 2019-11-22 Will not fix CWE-863

TI-2014-00145 CVE-2014-0151 · GHSA-64m5-2h4c-p759

Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows…

LOW 31

Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00644 Published 2015-02-13 Fixed CWE-352

TI-2020-08670 CVE-2020-10775 · GHSA-7wqr-p83r-v6rj

Open redirect in ovirt-engine

LOW 28

An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.0185 Published 2020-08-24 Partial fix CWE-451

TI-2018-00982 CVE-2018-1062 · GHSA-j45v-g64g-45w2

A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of…

LOW 27

A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt, could cause a disk to be incompletely zeroed when removed fro…

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01357 Published 2018-03-06 Partial fix · 4.1.9 CWE-212

TI-2018-15750 CVE-2018-1000095 · GHSA-xqr4-7mxg-hjgj

oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting (XSS) vulnerability in the…

LOW 23

oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting (XSS) vulnerability in the name/description of VMs portion of the web admin application.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00506 Published 2018-03-13 No fix listed CWE-79

Open these records in search →

Critical	792
High	2681
Medium	3429
Low	509
No CVSS	2