Vulnerabilidades em Red Hat

2.456 resultados
Análise Vexday

Com 1.477 CVEs catalogadas e 232 surgidas apenas nos últimos 90 dias, o volume de vulnerabilidades associadas ao Red Hat exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo, com apenas 1 CVE confirmada no CISA KEV — a CVE-2023-4911, que apresenta EPSS de 0,7861, indicando probabilidade elevada de exploração e merecendo atenção prioritária de equipes de resposta. Das 34 vulnerabilidades de severidade crítica, 18 contam com prova de conceito pública disponível, o que reduz a barreira técnica para exploração e aumenta o risco operacional. O tipo de falha mais recorrente é CWE-125 (leitura fora dos limites), padrão que frequentemente viabiliza vazamento de dados ou corrupção de memória e deve orientar revisões de hardening e priorização de patches.

CVE-2025-47712MEDIUMNbd: nbdkit: integer overflow triggers an assertion resulting in denial of serviceEPSS 0.5%CVE-2026-15378CRITICALGuardrails-detectors: guardrails-detectors: ssrf and local file read via user-supplied xml schema (xml-with-schema:)EPSS 0.5%CVE-2026-11770HIGH389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status checkEPSS 0.5%CVE-2026-73137HIGHMulticloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespaceEPSS 0.5%CVE-2025-3416LOWRust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`EPSS 0.5%CVE-2023-6606HIGHKernel: out-of-bounds read vulnerability in smbcalcsizeEPSS 0.5%CVE-2022-3205MEDIUMController: cross site scripting in automation controller uiEPSS 0.5%CVE-2026-76827MEDIUMSearch-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)EPSS 0.5%CVE-2024-11483MEDIUMAutomation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5EPSS 0.5%CVE-2026-18382MEDIUMProject-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_urlEPSS 0.5%CVE-2026-101292HIGHArtemis-core-client: unsafe reflection in apache activemq artemis federation message deserializationEPSS 0.5%CVE-2026-12545MEDIUMRubygem-hammer_cli: command injection via insecure editor invocationEPSS 0.5%CVE-2023-6110MEDIUMOpenstack: deleting a non existing access rule deletes another existing access rule in it's scopeEPSS 0.5%CVE-2026-18950HIGHOdh-dashboard: odh-dashboard: confused-deputy privilege escalation via unchecked roleref in rolebinding creationEPSS 0.5%CVE-2026-18217LOWKeycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollutionEPSS 0.5%CVE-2023-2422MEDIUMKeycloak: oauth client impersonationEPSS 0.5%CVE-2026-87743HIGHQuarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityEPSS 0.5%CVE-2024-9621MEDIUMIo.quarkiverse.cxf:quarkus-cxf: quarkus cxf may log user password and secret to application logEPSS 0.5%CVE-2025-6052LOWGlib: integer overflow in g_string_maybe_expand() leading to potential buffer overflow in glib gstringEPSS 0.5%CVE-2024-3622HIGHMirror-registry: plain-text default csrf secret keyEPSS 0.5%