CVE-2026-83589 is an open redirect vulnerability in the oauth-proxy component of Red Hat OpenShift Container Platform 4.14. The flaw allows improper validation of the destination redirect parameter during post-login redirection. An attacker can craft a link that redirects authenticated users to arbitrary external websites, potentially enabling phishing or credential theft attacks. The vulnerability requires user interaction and affects the trusted authentication gateway of OpenShift clusters.
CVE-2026-103641 is an out-of-bounds read vulnerability in the GEGL Radiance HDR loader used in Red Hat Enterprise Linux 10. The flaw occurs when an uncompressed scanline in an HDR image is shorter than the width declared in the file header, causing the loader to read past the end of a memory-mapped image. This can lead to a crash of the application that uses the loader when opening a crafted HDR file.
Podman versions from 4.4.0 up to but not including 5.8.8, and from 6.0.0 up to but not including 6.1.3, contain a vulnerability where podman run treats images with the io.podman.annotations.checkpoint.runtime.name annotation as checkpoints. This causes podman to ignore user-supplied container creation restrictions such as --cap-drop=ALL, potentially allowing weaker sandbox settings and capabilities. Rootless containers are not affected. The issue is fixed in versions 5.8.8 and 6.1.3.
Red Hat has released a security advisory for Red Hat Hardened Images RPMs, including multiple nodejs26-related packages and the v8-devel package. The update addresses several vulnerabilities identified by CVE-2026-102276, CVE-2026-102277, and CVE-2026-102278. The advisory provides updated package versions to fix bugs and enhance security. The update is available for aarch64 and x86_64 architectures as well as noarch packages. No specific technical details or exploitation methods are provided.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102)
* kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
* kernel: net/liquidio: drop cached VF pci_dev LUT (CVE-2026-72329)
* kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)
Bug Fix(es) and Enhancement(s):
* [RHEL 8.10] "kernel BUG at lib/list_debug.c:28!": list_add corruption in register_trace_event RHEL 8.10 (JIRA:RHEL-214136)
* request_key_auth use-after-free on every request-key upcall since 4.18.0-553.165.1 (regression from CVE-2026-63823 backport) (JIRA:RHEL-270349)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This security advisory addresses vulnerabilities in GVFS, the GNOME Virtual File System, specifically a heap-based buffer overflow in the SFTP component and a local privilege escalation via a socket ownership race condition. The update is rated as important by Red Hat and affects Red Hat Enterprise Linux 10 and its variants. The vulnerabilities could allow local users to gain elevated privileges or cause memory corruption. A security update is available to remediate these issues.
CVE-2026-103399 is a medium severity vulnerability in SoupServer (libsoup) used by Red Hat Enterprise Linux 10. It involves inconsistent handling of HTTP requests when a client sends an Expect: 100-continue header with a request body. If the server returns a final response before reading the body, it does not consume the body bytes nor close the connection, causing leftover bytes to be interpreted as a new HTTP request. This allows a remote unauthenticated attacker to smuggle an HTTP request, potentially causing unintended request processing.
Red Hat has released an important security update for the OpenShift File Integrity Operator (v1.5.0) that addresses multiple bugs and security vulnerabilities, including CVE-2026-56853. The update includes enhancements such as schema extensions, network policy improvements, TLS profile consistency, and a base image switch. The vulnerability CVE-2026-56853 is rated as high severity. Users are advised to apply this update after ensuring all prior relevant errata are installed.
CVE-2026-101295 is a path traversal vulnerability in Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2. It occurs in oc-mirror's operator catalog image extraction process, where tar entries from catalog image layers are extracted without validating that file paths remain within the intended destination directory. This can lead to arbitrary file writes outside the target directory.
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.16 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.15, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.16 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* mchange-commons-java: mchange-commons-java: Arbitrary code execution via
JNDI dereferencing of crafted objects [eap-7.1.z] (CVE-2026-27727)
* com.mchange/c3p0: c3p0: Arbitrary Code Execution via deserialization of
crafted objects [eap-7.1.z] (CVE-2026-27830)
* netty-codec: Netty: Denial of Service via excessive memory allocation in
LZ4FrameDecoder [eap-7.1.z] (CVE-2026-42583)
* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [eap-7.1.z] (CVE-2026-42578)
* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling
of conflicting HTTP/1.0 headers [eap-7.1.z] (CVE-2026-42581)
* netty-codec-http: Netty: Request smuggling via malformed
Transfer-Encoding parsing [eap-7.1.z] (CVE-2026-42585)
* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data
confusion [eap-7.1.z] (CVE-2026-42584)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-62146 is a high-severity trust boundary violation vulnerability in CRI-O's sandbox state persistence within Red Hat OpenShift Container Platform 4. An attacker can manipulate pod metadata to overwrite CRI-O's reserved sandbox bookkeeping data. After a restart, this manipulated data is trusted, allowing a container recreate operation to expose a host-side runtime-management resource inside the container. This exposure enables container escape, compromising container isolation.
Red Hat has issued a security advisory for a vulnerability identified as CVE-2026-102278 affecting the Red Hat Hardened Images RPMs, specifically multiple nodejs26 packages. The update addresses a CWE-770 weakness and updates nodejs26 and related components to version 26.10.0-0.2.hum1 across various architectures. No detailed technical information or exploitation methods are provided. Users are advised to apply the update through official Red Hat channels.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing vulnerabilities in the hdf5 packages. The update includes multiple hdf5-related RPMs for aarch64 and x86_64 architectures. The advisory addresses three CVEs: CVE-2026-19026, CVE-2026-19027, and CVE-2026-19028. No explicit patch version ranges are provided, but updated package versions are listed. The severity is assessed as medium.
Red Hat Advanced Cluster Management for Kubernetes has a security advisory addressing multiple vulnerabilities including CVE-2026-41178. This update includes new features, bug fixes, and updated container images to improve security and functionality. The advisory highlights fixes for issues such as image override regressions and other security concerns. The update is rated as important by Red Hat Product Security and affects specific versions of the product. A patch is available to remediate these vulnerabilities.
CVE-2026-102560 is a heap buffer overflow vulnerability in the libsoup library used by Red Hat Enterprise Linux 9. It occurs when the permessage-deflate WebSocket extension compresses a very large outgoing message, causing size calculations to wrap and zlib to write beyond allocated memory. This flaw can lead to memory corruption and potential denial of service or other impacts. Red Hat has released security updates addressing this issue in libsoup packages for Red Hat Enterprise Linux 9.
A heap buffer overflow vulnerability exists in libsoup's soup_uri_decode_data_uri() function in Red Hat Enterprise Linux 10. The function incorrectly handles base64 data-URI payloads containing embedded NUL bytes, leading to an uninitialized decoded length. This flaw can cause an out-of-bounds read or application crash when processing crafted data URIs. Red Hat has released an important security update addressing this issue in libsoup3.
CVE-2026-102623 is a vulnerability in Red Hat OpenShift Virtualization 4's KubeVirt component where an authenticated user with permission to create Virtual Machine Instances can cause a denial of service. This occurs by submitting a virtual machine definition containing an empty ephemeral volume, which leads the virt-controller to crash due to improper validation. The crash causes the controller to enter a continuous crash loop, disrupting virtual machine lifecycle operations cluster-wide.
CVE-2026-88841 is a medium severity vulnerability affecting multiple specific versions of BusyBox distributed in various Ubuntu releases. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available, and no known exploits in the wild have been reported. The affected versions are explicitly listed and correspond to various Ubuntu package versions of BusyBox.