Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #6OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  How to prevent and test

  1. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  2. Architecture and Design

     For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…

  3. Implementation · Input Validation

     Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).

  OWASP Cheat Sheets

  • Authorization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.3.1 (opens in a new tab)

  Attack patterns

  • Path Traversal (opens in a new tab)
  • Using Slashes and URL Encoding Combined to Bypass Validation Logic (opens in a new tab)
  • Manipulating Web Input to File System Calls (opens in a new tab)
  • Using Escaped Slashes in Alternate Encoding (opens in a new tab)
  • Using Slashes in Alternate Encoding (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-863Incorrect Authorization (opens in a new tab)

  Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #17OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

  How to prevent and test

  1. Architecture and Design

     Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.

  2. Architecture and Design

     Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records.

  3. Architecture and Design · Libraries or Frameworks

     Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  OWASP Cheat Sheets

  • Authorization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.3.8 (opens in a new tab)
  • V13.4.2 (opens in a new tab)
  • V7.2.2 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-303Incorrect Implementation of Authentication Algorithm (opens in a new tab)

  Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)

  The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

  How to prevent and test

  OWASP Cheat Sheets

  • OWASP Authentication (opens in a new tab)

  OWASP ASVS 4.0.3

  • V2.8.5 (opens in a new tab)
  • V2.8.4 (opens in a new tab)
  • V9.2.3 (opens in a new tab)

  Attack patterns

  • Reflection Attack in Authentication Protocol (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-201Insertion of Sensitive Information Into Sent Data (opens in a new tab)

  Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

  How to prevent and test

  1. Requirements

     Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.

  2. Implementation

     Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere.

  3. System Configuration

     Setup default error messages so that unexpected errors do not disclose sensitive information.

  OWASP Cheat Sheets

  • Error Handling (opens in a new tab)
  • Logging (opens in a new tab)
  • Authorization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.3.4 (opens in a new tab)
  • V14.3.3 (opens in a new tab)
  • V7.3.3 (opens in a new tab)

  Attack patterns

  • Choosing Message Identifier (opens in a new tab)
  • Exploiting Incorrectly Configured SSL/TLS (opens in a new tab)
  • WiFi MAC Address Tracking (opens in a new tab)
  • WiFi SSID Tracking (opens in a new tab)
  • Cellular Broadcast Message Request (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-434Unrestricted Upload of File with Dangerous Type (opens in a new tab)

  Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #12OWASP Top 10 A06:2025: Insecure Design (opens in a new tab)

  The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

  How to prevent and test

  1. Architecture and Design

     Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.

  2. Architecture and Design · Enforcement by Conversion

     When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

  3. Architecture and Design

     Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.

  OWASP Cheat Sheets

  • Server Side Request Forgery Prevention (opens in a new tab)
  • Web Service Security (opens in a new tab)
  • Third Party Javascript Management (opens in a new tab)
  • File Upload (opens in a new tab)
  • Secure Design Principles (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.5.2 (opens in a new tab)
  • V13.1.5 (opens in a new tab)
  • V12.2.1 (opens in a new tab)

  Attack patterns

  • Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-140Improper Neutralization of Delimiters (opens in a new tab)

  Base weakness

  The product does not neutralize or incorrectly neutralizes delimiters.

  How to prevent and test

  1. Implementation · Input Validation

     Developers should anticipate that delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.

  2. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  3. Implementation · Output Encoding

     While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)
  • Deserialization (opens in a new tab)
  • Server Side Request Forgery Prevention (opens in a new tab)
  • Unvalidated Redirects and Forwards (opens in a new tab)
  • Cross Site Scripting Prevention (opens in a new tab)

  OWASP ASVS 4.0.3

  • V1.5.1 (opens in a new tab)
  • V5.2.2 (opens in a new tab)

  Attack patterns

  • Command Delimiters (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-416Use After Free (opens in a new tab)

  Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #7

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

  How to prevent and test

  1. Architecture and Design · Language Selection

     Choose a language that provides automatic memory management.

  2. Implementation · Attack Surface Reduction

     When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-295Improper Certificate Validation (opens in a new tab)

  Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)

  The product does not validate, or incorrectly validates, a certificate.

  How to prevent and test

  1. Architecture and Design · Implementation

     Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.

  2. Implementation

     If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

  OWASP Cheat Sheets

  • Transport Layer Protection (opens in a new tab)
  • TLS Cipher String (opens in a new tab)
  • OWASP Authentication (opens in a new tab)

  OWASP ASVS 4.0.3

  • V9.2.1 (opens in a new tab)
  • V1.9.2 (opens in a new tab)
  • V2.8.5 (opens in a new tab)

  Attack patterns

  • Creating a Rogue Certification Authority Certificate (opens in a new tab)
  • Signature Spoofing by Improper Validation (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-347Improper Verification of Cryptographic Signature (opens in a new tab)

  Base weaknessOWASP Top 10 A04:2025: Cryptographic Failures (opens in a new tab)

  The product does not verify, or incorrectly verifies, the cryptographic signature for data.

  How to prevent and test

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • REST Security (opens in a new tab)
  • JSON Web Token for Java (opens in a new tab)
  • REST Assessment (opens in a new tab)
  • Cross-Site Request Forgery Prevention (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.2 (opens in a new tab)
  • V3.5.3 (opens in a new tab)
  • V13.2.6 (opens in a new tab)

  Attack patterns

  • Padding Oracle Crypto Attack (opens in a new tab)
  • Signature Spoofing by Improper Validation (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-125Out-of-bounds Read (opens in a new tab)

  Base weaknessCWE Top 25 (2025): #8

  The product reads data past the end, or before the beginning, of the intended buffer.

  How to prevent and test

  1. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  2. Architecture and Design · Language Selection

     Use a language that provides appropriate memory abstractions.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  Attack patterns

  • Overread Buffers (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-191Integer Underflow (Wrap or Wraparound) (opens in a new tab)

  Base weakness

  The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #11

  The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

  How to prevent and test

  1. Requirements · Language Selection

     Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  2. Architecture and Design · Libraries or Frameworks

     Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  3. Operation · Build and Compilation · Environment Hardening

     Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…

  OWASP Cheat Sheets

  • Docker Security (opens in a new tab)
  • XML Security (opens in a new tab)

  OWASP ASVS 4.0.3

  • V5.4.1 (opens in a new tab)
  • V14.1.2 (opens in a new tab)
  • V13.3.1 (opens in a new tab)

  Attack patterns

  • Buffer Overflow via Environment Variables (opens in a new tab)
  • Overflow Buffers (opens in a new tab)
  • Client-side Injection-induced Buffer Overflow (opens in a new tab)
  • Filter Failure through Buffer Overflow (opens in a new tab)
  • MIME Conversion (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-415Double Free (opens in a new tab)

  Variant weaknessLikelihood of exploit: High

  The product calls free() twice on the same memory address.

  How to prevent and test

  1. Architecture and Design

     Choose a language that provides automatic memory management.

  2. Implementation

     Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly.

  3. Implementation

     Use a static analysis tool to find double free instances.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25

  The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

  How to prevent and test

  1. Requirements

     Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

  2. Architecture and Design

     Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

  3. Architecture and Design

     Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.1.4 (opens in a new tab)
  • V13.4.1 (opens in a new tab)
  • V11.1.4 (opens in a new tab)

  Attack patterns

  • XML Ping of the Death (opens in a new tab)
  • Exponential Data Expansion (opens in a new tab)
  • Serialized Data Parameter Blowup (opens in a new tab)
  • Serialized Data with Nested Payloads (opens in a new tab)
  • Oversized Serialized Data Payloads (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)

  Base weaknessLikelihood of exploit: Medium

  The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

  How to prevent and test

  1. Implementation

     The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.

  2. Implementation

     When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

  3. Architecture and Design

     Limit the interleaving of operations on files from multiple processes.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)

  OWASP ASVS 4.0.3

  • V1.11.3 (opens in a new tab)
  • V11.1.6 (opens in a new tab)
  • V1.11.2 (opens in a new tab)

  Attack patterns

  • Leveraging Race Conditions via Symbolic Links (opens in a new tab)
  • Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-59Improper Link Resolution Before File Access ('Link Following') (opens in a new tab)

  Base weaknessLikelihood of exploit: MediumOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

  How to prevent and test

  1. Architecture and Design · Separation of Privilege

     Follow the principle of least privilege when assigning access rights to entities in a software system.

  OWASP Cheat Sheets

  • Authorization (opens in a new tab)

  Attack patterns

  • Symlink Attack (opens in a new tab)
  • Using Malicious Files (opens in a new tab)
  • Leverage Executable Code in Non-Executable Files (opens in a new tab)
  • Manipulating Web Input to File System Calls (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-1333Inefficient Regular Expression Complexity (opens in a new tab)

  Base weaknessLikelihood of exploit: High

  The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

  How to prevent and test

  1. Architecture and Design

     Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.

  2. System Configuration

     Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.

  3. Implementation

     Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.

  OWASP Cheat Sheets

  • File Upload (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.1.1 (opens in a new tab)

  Attack patterns

  • Regular Expression Exponential Blowup (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-126Buffer Over-read (opens in a new tab)

  Variant weakness

  The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

  How to prevent and test

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-193Off-by-one Error (opens in a new tab)

  Base weakness

  A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

  How to prevent and test

  1. Implementation

     When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array.

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (opens in a new tab)

  Base weaknessOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)

  The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

  How to prevent and test

  1. Implementation

     Use a web server that employs a strict HTTP parsing procedure, such as Apache.

  2. Implementation

     Use only SSL communication.

  3. Implementation

     Terminate the client session after each request.

  OWASP Cheat Sheets

  • REST Assessment (opens in a new tab)
  • REST Security (opens in a new tab)
  • Cross-Site Request Forgery Prevention (opens in a new tab)
  • Secure Design Principles (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.2.5 (opens in a new tab)

  Attack patterns

  • HTTP Response Smuggling (opens in a new tab)
  • HTTP Request Smuggling (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-606Name not in the CWE catalogue (opens in a new tab)
• CWE-824Name not in the CWE catalogue (opens in a new tab)
• CWE-835Name not in the CWE catalogue (opens in a new tab)
• CWE-839Name not in the CWE catalogue (opens in a new tab)
• CWE-1050Name not in the CWE catalogue (opens in a new tab)
• CWE-918Name not in the CWE catalogue (opens in a new tab)
• CWE-76Name not in the CWE catalogue (opens in a new tab)
• CWE-407Name not in the CWE catalogue (opens in a new tab)

• access.redhat.com/errata/RHSA-2024:2816 (opens in a new tab)
• access.redhat.com/security/updates/classification/ (opens in a new tab)
• docs.openshift.com/gitops/1.12/release_notes/gitops-release-notes.html (opens in a new tab)
• docs.openshift.com/gitops/1.12/understanding_openshift_gitops/about-redhat-openshift-gitops.html (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2270863 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2275189 (opens in a new tab)
• issues.redhat.com/browse/GITOPS-3736 (opens in a new tab)
• issues.redhat.com/browse/GITOPS-3947 (opens in a new tab)
• issues.redhat.com/browse/GITOPS-4226 (opens in a new tab)
• issues.redhat.com/browse/GITOPS-4303 (opens in a new tab)
• issues.redhat.com/browse/GITOPS-4358 (opens in a new tab)
• issues.redhat.com/browse/GITOPS-4496 (opens in a new tab)
• issues.redhat.com/browse/GITOPS-4513 (opens in a new tab)
• issues.redhat.com/browse/GITOPS-4543 (opens in a new tab)
• issues.redhat.com/browse/GITOPS-4645 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2816.json (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:61783 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2024-29180 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-11822 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-11824 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-11979 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-14164 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-15588 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-18477 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-18508 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-1965 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-3783 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-41991 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-41992 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-45409 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-45623 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-54284 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-54371 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-56434 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-5704 (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-58010 (opens in a new tab)

• Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usageHighVulnerability08/31/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.CriticalVulnerability10/22/2026
• Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.CriticalVulnerability10/22/2026