Vulnerabilidades em Red Hat

2.456 resultados
Análise Vexday

Com 1.477 CVEs catalogadas e 232 surgidas apenas nos últimos 90 dias, o volume de vulnerabilidades associadas ao Red Hat exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo, com apenas 1 CVE confirmada no CISA KEV — a CVE-2023-4911, que apresenta EPSS de 0,7861, indicando probabilidade elevada de exploração e merecendo atenção prioritária de equipes de resposta. Das 34 vulnerabilidades de severidade crítica, 18 contam com prova de conceito pública disponível, o que reduz a barreira técnica para exploração e aumenta o risco operacional. O tipo de falha mais recorrente é CWE-125 (leitura fora dos limites), padrão que frequentemente viabiliza vazamento de dados ou corrupção de memória e deve orientar revisões de hardening e priorização de patches.

CVE-2026-18608HIGHData-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wideEPSS 0.7%CVE-2023-5380MEDIUMXorg-x11-server: use-after-free bug in destroywindowEPSS 0.7%CVE-2025-4945LOWLibsoup: integer overflow in cookie expiration date handling in libsoupEPSS 0.7%CVE-2020-10727—A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plainEPSS 0.7%CVE-2022-4132MEDIUMMemory leak on tls connectionsEPSS 0.7%CVE-2022-4245MEDIUMCodehaus-plexus: xml external entity (xxe) injectionEPSS 0.7%CVE-2023-2585LOWKeycloak: client access via device auth request spoofEPSS 0.7%CVE-2026-71475MEDIUMInsights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url pathEPSS 0.7%CVE-2025-13888CRITICALOpenshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobsEPSS 0.7%CVE-2026-28369HIGHUndertow: undertow: request smuggling via malformed http request headersEPSS 0.7%CVE-2026-14450CRITICALMaas-billing: maas api: privilege escalation via forged http headers due to missing authenticationEPSS 0.7%CVE-2026-66792CRITICALMulticloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clustersEPSS 0.7%CVE-2024-4369MEDIUMCluster-image-registry-operator: exposes a secret via env variable in pod definition on azureEPSS 0.7%CVE-2023-7090MEDIUMSudo: improper handling of ipa_hostname leads to privilege mismanagementEPSS 0.7%CVE-2019-14866MEDIUMIn all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR arcEPSS 0.7%CVE-2026-107123HIGHKeycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsingEPSS 0.7%CVE-2026-19607MEDIUMKeycloak-services: keycloak-services: broker-originated username collision causes account lockoutEPSS 0.7%CVE-2019-3872MEDIUMIt was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x anEPSS 0.7%CVE-2026-11774HIGH389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflowEPSS 0.7%CVE-2024-8768HIGHVllm: a completions api request with an empty prompt will crash the vllm api server.EPSS 0.7%