Vulnerabilidades em Red Hat

2.125 resultados
Análise Vexday

Com 1.477 CVEs catalogadas e 232 surgidas apenas nos últimos 90 dias, o volume de vulnerabilidades associadas ao Red Hat exige monitoramento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo, com apenas 1 CVE confirmada no CISA KEV — a CVE-2023-4911, que apresenta EPSS de 0,7861, indicando probabilidade elevada de exploração e merecendo atenção prioritária de equipes de resposta. Das 34 vulnerabilidades de severidade crítica, 18 contam com prova de conceito pública disponível, o que reduz a barreira técnica para exploração e aumenta o risco operacional. O tipo de falha mais recorrente é CWE-125 (leitura fora dos limites), padrão que frequentemente viabiliza vazamento de dados ou corrupção de memória e deve orientar revisões de hardening e priorização de patches.

CVE-2025-12103MEDIUMOpenshift-ai: trusty ai grants all authenticated users to list pods in any namespaceEPSS 0.2%CVE-2026-13318MEDIUMVirt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ipEPSS 0.2%CVE-2026-76648HIGHAutomation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recoveryEPSS 0.2%CVE-2026-88831MEDIUMBusybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengthsEPSS 0.2%CVE-2026-0598MEDIUMAnsible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiEPSS 0.2%CVE-2023-2680HIGHDma reentrancy issue (incomplete fix for cve-2021-3750)EPSS 0.2%CVE-2026-80110HIGHPki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpointEPSS 0.2%CVE-2025-6196MEDIUMLibgepub: integer overflow in libgepub's epub archive handlingEPSS 0.2%CVE-2024-0340MEDIUMKernel: information disclosure in vhost/vhost.c:vhost_new_msg()EPSS 0.2%CVE-2026-84232MEDIUMPulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg contentEPSS 0.2%CVE-2025-1272HIGHKernel: secure boot does not automatically enable kernel lockdownEPSS 0.2%CVE-2025-11429MEDIUMKeycloak-server: too long and not settings compliant sessionEPSS 0.2%CVE-2026-80101MEDIUMGimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validationEPSS 0.2%CVE-2026-71576HIGHMulticluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlersEPSS 0.2%CVE-2023-5090MEDIUMKernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrsEPSS 0.2%CVE-2024-8939MEDIUMVllm: denials of service in vllm json web apiEPSS 0.2%CVE-2023-4385MEDIUMKernel: jfs: null pointer dereference in dbfree()EPSS 0.2%CVE-2026-18967MEDIUMKeycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flowEPSS 0.2%CVE-2026-14935LOWGstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence checkEPSS 0.2%CVE-2023-5088MEDIUMQemu: improper ide controller reset can lead to mbr overwriteEPSS 0.2%