CVE-2026-101919 is a high-severity vulnerability in Red Hat Multicluster Engine for Kubernetes involving improper input validation in the HyperShift operator. The operator copies user-supplied kubeconfig secrets into a privileged namespace without proper sanitization. An authenticated user with permissions to create clusters and secrets can exploit this by providing a configuration with unauthorized executable plugins, potentially leading to arbitrary code execution in the control plane.
A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.
A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf.
A denial of service vulnerability exists in the Golang crypto/tls package used by Red Hat OpenShift Virtualization v4.21 images. The issue involves indefinite KeyUpdate messages that can cause service disruption. Red Hat has released OpenShift Container Platform 4.21.34 with updated packages and images that address this vulnerability. Users of OpenShift Container Platform 4.21 are advised to upgrade to these versions to remediate the issue.
This advisory addresses multiple security issues in the Linux kernel, including a TOCTOU double-fetch vulnerability in the mana network driver (CVE-2026-64034) and a hash offset increment bug in dm-integrity (CVE-2026-72099). These vulnerabilities could potentially allow attackers to cause unintended behavior or information exposure. The update also includes various bug fixes and enhancements. A patch is available to remediate these issues.
CVE-2026-105306 is a vulnerability in the Dynamic Client Registration flow of the Red Hat Build of Keycloak. It allows an attacker with a valid Initial Access Token to register a client that bypasses audience checks during token introspection. This flaw enables unauthorized viewing of sensitive identity information, roles, and session details from access tokens of other applications within the same realm. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This allows a delegated client administrator to leak a user's upstream bearer tokens into the tokens issued to their managed application, potentially leading to unauthorized access to the user's data on external platforms.
A high-severity vulnerability (CVE-2026-76561) affects the pki-core:10.6 module in Red Hat Enterprise Linux 8. The issue involves the certprofile-import component of Dogtag/PKI, which allows code execution via unsanitized profile content, categorized under CWE-78 (command injection). Red Hat has issued an important security advisory with an update to address this vulnerability. No known exploits in the wild have been reported. The update is available for multiple Red Hat Enterprise Linux 8 variants and architectures.
A high severity vulnerability (CVE-2026-22984) in the Linux kernel's libceph component was resolved by adding explicit bounds checking to prevent potential out-of-bounds reads in the handle_auth_done() function. This vulnerability could lead to serious impacts including confidentiality, integrity, and availability violations. The issue affects multiple Linux kernel versions prior to specific patched releases. Ubuntu has released security updates addressing this and numerous other kernel vulnerabilities. Users are advised to update to the fixed kernel versions and reboot their systems. Due to ABI changes, recompilation of third-party kernel modules may be necessary.
CVE-2026-104988 is a high-severity authentication bypass vulnerability in Red Hat Certificate System 10's Dogtag PKI component. The flaw occurs in the CMCAuthForEST authentication plugin, which incorrectly allows an EST fullcmc enrollment request via BasicAuth without a TLS client certificate to be treated as agent-privileged. This enables an authenticated EST user to obtain CA-signed certificates with arbitrary subject names, potentially compromising certificate issuance integrity.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana12.4 package to address multiple security vulnerabilities identified by CVE identifiers including CVE-2026-101903 and CVE-2026-93450. The advisory provides updated RPM packages for the aarch64 and x86_64 architectures. No explicit affected versions are detailed in the advisory. The update is classified as a security fix and is available via Red Hat's official channels.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically addressing vulnerabilities in the grafana12.4 package. The update fixes CVE-2026-93981, which affects versions prior to 12.4.10-0.10.hum1. No explicit CVSS score is provided, but the severity is assessed as high. The advisory includes updated RPMs for aarch64 and x86_64 architectures. No known exploits are reported in the wild, and no official fix beyond the update is mentioned.
Red Hat has issued a security update for Red Hat Hardened Images RPMs addressing a vulnerability identified as CVE-2026-17084 in python3.10 packages. The update includes multiple python3.10-related RPMs for aarch64 and x86_64 architectures. No specific details about the nature of the vulnerability or its exploitation are provided. The severity is assessed as medium.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-6.12.0-211.16.1.el10_2.
Security Fix(es):
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing high severity vulnerabilities identified by CVE-2026-94603 and CVE-2026-79705. The update affects several podman-related packages including podman, podman-docker, podman-machine, podman-remote, and podmansh. The advisory does not provide detailed technical information about the vulnerabilities but classifies them as high severity. Updated RPMs version 6.1.3-1.hum1 are available for affected architectures. No explicit patch version range is provided, but the advisory indicates that the update resolves the issues. No known exploits in the wild have been reported.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple updated httpd-related packages. This update addresses several security issues identified by multiple CVEs. The advisory provides updated RPM versions for aarch64 and x86_64 architectures but does not specify detailed vulnerability descriptions or affected versions. The advisory indicates a high severity level and provides updated packages to remediate the issues.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
* kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
* kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
Bug Fix(es) and Enhancement(s):
* Backport of protocol attribute to IP addresses (IFA_PROTO) [rhel-9.8.z] (JIRA:RHEL-169936)
* try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [rhel-9.8.z] (JIRA:RHEL-269060)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-86345 is a critical vulnerability in Red Hat Directory Server 11 where the server improperly handles buffered plaintext bytes during StartTLS negotiation. This flaw allows an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade, causing the client to potentially treat a failed authentication attempt as successful due to message ID collision.