Vulnerabilities in Red Hat

2,125 results
Vexday analysis

Com 1.477 CVEs catalogadas e 232 surgidas apenas nos últimos 90 dias, o volume de vulnerabilidades associadas ao Red Hat exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo, com apenas 1 CVE confirmada no CISA KEV — a CVE-2023-4911, que apresenta EPSS de 0,7861, indicando probabilidade elevada de exploração e merecendo atenção prioritária de equipes de resposta. Das 34 vulnerabilidades de severidade crítica, 18 contam com prova de conceito pública disponível, o que reduz a barreira técnica para exploração e aumenta o risco operacional. O tipo de falha mais recorrente é CWE-125 (leitura fora dos limites), padrão que frequentemente viabiliza vazamento de dados ou corrupção de memória e deve orientar revisões de hardening e priorização de patches.

CVE-2025-32053MEDIUMLibsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()EPSS 0.6%CVE-2024-31420MEDIUMCnv: dos through repeatedly calling vm-dump-metrics until virt handler crashesEPSS 0.6%CVE-2026-93492MEDIUMIo.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table sizeEPSS 0.6%CVE-2024-5967LOWKeycloak: leak of configured ldap bind credentials through the keycloak admin consoleEPSS 0.6%CVE-2026-56209HIGHLibaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijackEPSS 0.6%CVE-2017-7514MEDIUMA cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before version 5.8.0. A user abEPSS 0.6%CVE-2023-0456HIGHApicast proxies the api call with incorrect jwt token to the api backend without proper authorization checkEPSS 0.6%CVE-2026-76560HIGH389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dnEPSS 0.6%CVE-2025-12744HIGHAbrt: command-injection in abrt leading to local privilege escalationEPSS 0.6%CVE-2026-10059CRITICALCluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount tokenEPSS 0.6%CVE-2025-4953HIGHPodman: build context bind mountEPSS 0.6%CVE-2024-10234MEDIUMWildfly: wildfly vulnerable to cross-site scripting (xss)EPSS 0.6%CVE-2026-93565HIGHIo.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byteEPSS 0.6%CVE-2026-93566MEDIUMIo.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size lineEPSS 0.6%CVE-2025-11021HIGHLibsoup: out-of-bounds read in cookie date handling of libsoup http libraryEPSS 0.6%CVE-2023-4380MEDIUMPlatform: token exposed at importing projectEPSS 0.6%CVE-2026-34956MEDIUMOpenvswitch: open vswitch: denial of service via malformed ftp epasv commandEPSS 0.6%CVE-2016-7070HIGHA privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configuresEPSS 0.6%CVE-2025-14831MEDIUMGnutls: gnutls: denial of service via excessive resource consumption during certificate verificationEPSS 0.6%CVE-2023-43785MEDIUMLibx11: out-of-bounds memory access in _xkbreadkeysyms()EPSS 0.6%