CVE-2026-71458 is a vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8 where the URLModificationMiddleware resolves named-URL lookups against unfiltered model objects before RBAC enforcement. This causes a difference in 403 versus 404 response messages, allowing an attacker to distinguish whether certain named resources exist anywhere on the platform. This enables cross-tenant internal hostname enumeration. The vulnerability has a medium severity with a CVSS score of 5. A vendor advisory is available but does not explicitly confirm patch status for this specific issue.
Red Hat has released a security advisory addressing multiple vulnerabilities in Red Hat Hardened Images RPMs, specifically updating nodejs24 and nodejs26 packages. The advisory includes bug fixes and enhancements for CVE-2026-18540, CVE-2026-19534, CVE-2026-84961, and CVE-2026-85024. Updated packages cover architectures including aarch64 and x86_64. No known exploits have been reported in the wild. The advisory provides updated package versions to mitigate these vulnerabilities.
CVE-2026-88830 is a high-severity vulnerability in Red Hat Hardened Images caused by an incorrect buffer size calculation in BusyBox TLS Montgomery reduction. This flaw leads to a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message. The vulnerability does not impact confidentiality or integrity but can cause denial of service due to application crash or instability.
CVE-2026-88832 is a heap buffer overflow vulnerability in BusyBox's romfs volume ID parsing within Red Hat Hardened Images. The flaw arises from using an unbounded strlen on attacker-controlled metadata when processing crafted filesystem images. This vulnerability has a high severity rating with a CVSS score of 7.3, impacting confidentiality, integrity, and availability. Red Hat has released an update to BusyBox version 1.37.0-9.1.hum1 that addresses this issue.
CVE-2026-5241 is a high-severity vulnerability in Red Hat AI Inference Server 3.4.5 (spyre) affecting the mlx-lm product, specifically in the huggingface/transformers LightGlue model loading path. It allows arbitrary code execution during model initialization. The vulnerability has a CVSS score of 8.0 and requires user interaction with high attack complexity. No known exploits in the wild have been reported. The Red Hat advisory lists this CVE among multiple others affecting the product but does not provide specific patch or fix details.
A cross-site scripting (XSS) vulnerability (CVE-2026-75838) was found in the DOMPurify library used by Red Hat Hardened Images RPMs, specifically in the grafana13.2 package. The issue occurs during in-place sanitization when element-removal hooks fail to neutralize detached subtrees, allowing malicious scripts to execute via crafted HTML with event handlers. This vulnerability requires a non-default DOMPurify configuration with an element-removal hook and user interaction with malicious content. Red Hat has released updated RPMs including grafana13.2-13.2.1-0.6.hum1 to fix this issue. Default DOMPurify configurations are not affected.
If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.
CVE-2026-96275 is a path traversal vulnerability in Flatpak on Red Hat Enterprise Linux 10 that allows a malicious or compromised Flatpak repository to write attacker-controlled content to arbitrary locations on the host filesystem. This occurs because path operations follow symlinks and blob names are not sanitized against directory traversal sequences. On system installations, the write happens with root privileges, leading to a high severity risk. Red Hat has released an important security update addressing this issue in Flatpak packages for RHEL 10.
CVE-2026-96512 is a high-severity vulnerability in sudo on Red Hat Enterprise Linux 10. It involves incorrect authorization when sudoers rules use NOTBEFORE or NOTAFTER time-based restrictions with timestamps missing the trailing 'Z' timezone indicator. An unprivileged local user can manipulate the TZ environment variable to shift the authorization window by up to about 25 hours, allowing execution of commands outside the intended time window. Authentication is not bypassed, only the time-based authorization check is affected. Red Hat has released an update to address this issue.
A security advisory from Red Hat addresses a medium severity vulnerability identified as CVE-2026-84783 affecting Red Hat Hardened Images RPMs, specifically the openssl3 packages. The update includes new versions of openssl3-devel, openssl3-devel-engine, openssl3-libs, and the openssl3 source package. The advisory provides updated RPMs for aarch64 and x86_64 architectures. No explicit fix details or exploit reports are mentioned.
A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user's password to bypass the second-factor authentication by providing a specially crafted header in their request.
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2.
Red Hat has released a critical security advisory for the Red Hat Hardened Images RPMs, specifically updating the openshell, openshell-gateway, and python3-openshell packages to version 0.0.116-0.2.hum1 on aarch64 and x86_64 architectures. The advisory addresses multiple CVEs including CVE-2026-65083, CVE-2026-65093, and CVE-2026-93599, but does not provide detailed vulnerability descriptions or CVSS scores. The update is intended as a bug fix and enhancement to improve security.
A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs.
A vulnerability in the GStreamer gst-plugins-good package affects the rtph264depay and rtph265depay RTP depayloader elements. These elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing, allowing a remote unauthenticated attacker to cause unbounded memory growth and denial of service. The vulnerability is exploitable when processing RTP from untrusted sources without authentication. Red Hat has released a security update to address this issue.
Red Hat has issued a security advisory for Red Hat Enterprise Linux 9.6 Extended Update Support addressing four kernel vulnerabilities affecting netfilter nf_tables, blk-mq cached requests, slab zeroing behavior, and SCTP transport handling. The update also includes bug fixes and enhancements for Intel drivers. Systems must be rebooted after applying the update to activate the fixes. The advisory rates the security impact as Important. No CVSS score is provided and no known exploits are reported in the wild.
A denial of service vulnerability (CVE-2026-56860) exists in the golang net/url package used by the host metering service in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issue is caused by quadratic complexity in path resolution when processing relative paths containing parent directory segments ('..'), which can lead to service disruption. Red Hat has released a security update to address this vulnerability.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
* kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)
* kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)
* kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
* kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)
* kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
* kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
Bug Fix(es) and Enhancement(s):
* WARNING: CPU: 5 PID: 20420 at net/core/stream.c:206 sk_stream_kill_queues+0xd2/0xe0 (JIRA:RHEL-256439)
* Backport 3e684903a857 - kpatch transition stalls on KVM vCPU threads running guest DPDK PMD [9.2.z] (JIRA:RHEL-258954)
* Backport request 747f7a2901174 [rhel-9.2.z] (JIRA:RHEL-259005)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.