Multiple security vulnerabilities have been identified in Vim (Vi IMproved) affecting Red Hat Enterprise Linux 10.0 Extended Update Support and related packages. These include arbitrary code execution via crafted inputs such as directory names, Python omni-completion, PHP files, tags files, and insecure shell command handling. Additionally, denial of service vulnerabilities exist due to stack out-of-bounds writes and out-of-bounds writes in spell file word counts. Red Hat has issued security advisories and updates addressing these vulnerabilities.
A stack buffer overflow vulnerability (CVE-2025-6170) exists in the libxml2 library's xmllint interactive shell command handling on Red Hat Enterprise Linux 8 and related products. Red Hat has rated the security impact as low. A security update is available that addresses this vulnerability by updating the libxml2 package. No known exploits are reported in the wild.
Red Hat has issued a security update for PostgreSQL 12 addressing multiple vulnerabilities that allow arbitrary code execution during restore operations and via untrusted data inclusion in pg_dump. These vulnerabilities could enable an attacker to execute code on affected systems. The update is rated as important by Red Hat Product Security. The advisory applies to Red Hat Enterprise Linux 8.6 and related variants. Users are advised to apply the provided updates to mitigate these issues.
CVE-2026-96284 is a low-severity vulnerability in Red Hat Enterprise Linux 10 where improper link resolution before file access allows a malicious user to read files in the flatpak-system-helper context. This occurs if a system OCI repository is configured and the OCI code paths follow symlinks when importing OCI images controlled by the user.
A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.
By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal tracking, making it impossible for the owning user to stop it. Ongoing pulls cannot be stopped.
CVE-2026-96281 is an improper access control vulnerability in Red Hat Enterprise Linux 10 involving Flatpak app version downgrades. A local user with an active login session can remove the app's remote reference via an unprivileged method, causing the anti-downgrade mechanism to fail. This allows the user to downgrade a system-wide Flatpak app to an older version that may contain unfixed vulnerabilities, potentially exposing other users on the same system to risk.
A numeric truncation error in the OCI delta stream parser of flatpak on 32-bit Red Hat Enterprise Linux 10 systems causes heap buffer overflows. This occurs because 64-bit size values are truncated to 32-bit during memory allocation, leading to undersized buffers. An attacker controlling an OCI registry can exploit this vulnerability during flatpak install or update operations to potentially execute arbitrary code.
CVE-2026-96279 is a vulnerability in Red Hat Enterprise Linux 10 involving improper link resolution before file access during Flatpak application installation or update from an OCI remote. A malicious OCI registry can create hardlinks to arbitrary host files in the extraction directory, potentially exposing sensitive host file contents. For system-wide installs executed as root, this includes critical files such as /etc/shadow. The vulnerability has a CVSS score of 6.5 (medium severity).
Node DOMPurify versions before 3.4.13 contain a cross-site scripting (XSS) vulnerability related to IN_PLACE sanitization where element-removal hooks fail to neutralize malicious input. Red Hat has issued an advisory updating the grafana13.2 package to address this and other vulnerabilities. The update is available for specific versions on aarch64 and x86_64 architectures. The vulnerability is classified as medium severity.
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.
A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite roles to see what other permissions they contain, an administrator with limited rights can assign a role that secretly includes full administrative control. This allows the attacker to gain complete management access over the entire realm.
Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token that bypasses these security protections.
A vulnerability in the python-cryptography library allows duplicate self-signed intermediate certificates to cause exponential path-building. This can lead to performance degradation or denial of service. The issue affects multiple versions of the library and has been assigned CVE-2026-69249. A security update addressing this vulnerability is available from Red Hat.
Multiple security vulnerabilities were identified in the libxml2 library, including arbitrary code execution via heap-based and stack-based buffer overflows, data integrity issues from integer overflow, information disclosure, SSRF, denial of service, and double-free/use-after-free in Python bindings. These issues affect various versions of libxml2 used in Red Hat Enterprise Linux and Ubuntu distributions. Fixes have been released and are available through standard system updates or Ubuntu Pro for extended support versions.
Multiple security vulnerabilities affecting the Linux kernel in Red Hat Enterprise Linux have been addressed in an official security update. These vulnerabilities include use-after-free, out-of-bounds reads, integer overflows, memory corruption, denial of service, and buffer overflow issues across various kernel subsystems such as fbcon, libceph, drm/amdgpu, netfilter, accel/ivpu, and others. The update is rated as important by Red Hat Product Security and includes official patches to remediate these issues.
A denial of service vulnerability (CVE-2026-56860) exists in the golang net/url package due to quadratic complexity in path resolution. This affects the host metering service in Red Hat Enterprise Linux, including Extended Lifecycle Support versions. The vulnerability can cause service disruption by exhausting resources during URL path processing. Red Hat has issued security advisories and updates to address this issue.
CVE-2026-90959 is a path traversal vulnerability in the pulpcore component of Red Hat Ansible Automation Platform 2.6 for RHEL 9. The vulnerability arises from improper validation of the 'file_url' parameter in the content upload API, allowing authenticated users with low repository privileges to read arbitrary files on the server. In environments using Pulp Container, exploitation can lead to theft of the container registry token signing private key, enabling unauthorized access to private container repositories. Red Hat has released an update addressing this issue.