Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing multiple vulnerabilities in the helm4 package version 4.2.3-0.1.2.hum1 for aarch64 and x86_64 architectures. The advisory highlights CVE-2026-63308 among other CVEs with a high severity rating. No newer patched version is explicitly stated, and no active exploitation in the wild has been reported. The update is relevant to Migration Toolkit for Virtualization components using this helm4 package version.
Red Hat has released an important security update for the Red Hat build of Quarkus 3.33.4 that addresses multiple vulnerabilities across various components including jackson-databind, jackson-core, Hibernate Validator, MongoDB Java Driver, RESTEasy, and others. The update fixes issues such as denial of service, path traversal, information disclosure, cross-site scripting, memory leaks, and certificate validation bypass. These vulnerabilities affect the Quarkus 3.33 build and related libraries. The advisory recommends applying this update after ensuring all previous errata are applied.
CVE-2026-109131 is a stored cross-site scripting (XSS) vulnerability in the Hub collection module documentation renderer of Red Hat Ansible Automation Platform 2. The vulnerability arises because the UI renders documentation URLs without restricting the URL scheme, allowing script-executing URLs to run in the context of the Hub UI. This affects versions in the 2.6 and 2.7 release branches. The vulnerability requires an authenticated user to view and activate the malicious link. The CVSS score is 5.4, indicating medium severity.
CVE-2026-108334 is a vulnerability in Red Hat Connectivity Link 1.4 involving improper neutralization of special elements in an expression language statement. The internal WebAssembly shim used by the Kuadrant operator does not correctly escape values from HTTPRoute match fields, allowing a user with permission to create or modify HTTPRoute objects attached to a shared Gateway to craft values that bypass Gateway-level authentication and rate limiting checks. The request is still forwarded to the backend, potentially allowing unauthorized access or abuse. Red Hat has issued a security update addressing this issue.
CVE-2026-85634 is a path traversal vulnerability in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library used by WildFly and JBoss EAP, affecting Red Hat Fuse 7. An attacker with the Deployer RBAC role can exploit this flaw by supplying an unsanitized deployment name containing path traversal sequences to access files outside the intended deployment directory. This can lead to deletion or creation of arbitrary files and directories, resulting in full privilege escalation to the management SuperUser role. The vulnerability has a high severity with a CVSS score of 8.8.
Kiali 1.73.25, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently
Security Fix(es):
* kiali-ossmc-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031)
* kiali-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031)
* kiali-ossmc-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756)
* kiali-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756)
CVE-2026-92982 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2.6 involving improper neutralization of special elements in a Jinja2 template engine. A low-privileged Kubernetes user can exploit this flaw by crafting malicious custom resource specifications that are processed without proper sanitization, enabling execution of arbitrary code within the operator pod. This can lead to privilege escalation and full control over the operator's service account with cluster-wide permissions. Red Hat has issued an official security advisory and update addressing this issue.
Red Hat has issued a security advisory addressing multiple vulnerabilities, including the high-severity CVE-2026-41178, affecting Red Hat Advanced Cluster Management for Kubernetes and related products such as the Migration Toolkit for Applications and Red Hat Trusted Artifact Signer. These vulnerabilities impact various versions of Red Hat's Kubernetes management and application migration components. A patch is available to remediate these issues.
Two security vulnerabilities were identified in the lrzsz package used in Red Hat Enterprise Linux 8. These include an arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840) and arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841). Red Hat has issued an important security advisory with updates that fix these issues along with other bug fixes and enhancements. The vulnerabilities affect multiple architectures of Red Hat Enterprise Linux 8. The advisory provides updated packages to remediate these security flaws.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.15. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:68550
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
A critical security vulnerability (CVE-2026-53939) exists in the cjose C library, which implements Javascript Object Signing and Encryption (JOSE). The flaw involves the use of an all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption, weakening the encryption and potentially compromising data confidentiality. Red Hat has issued a security update addressing this issue for Red Hat Enterprise Linux 10.0 Extended Update Support and related products. Users are advised to apply the update as detailed in the Red Hat advisory.
Red Hat has issued a security advisory for an update to Red Hat Hardened Images RPMs, specifically including multiple nodejs26-related packages. The update addresses a security issue identified as CVE-2026-109855. No explicit details on the nature of the vulnerability or its exploitation are provided. The advisory lists updated package versions for nodejs26 and related components across multiple architectures.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
* kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
* kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
* kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
* kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
* kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
* kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
* kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
* kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)
Bug Fix(es) and Enhancement(s):
* powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:RHEL-240146)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat AI Inference 3.4.6 (rocm) is identified with multiple security vulnerabilities including CVE-2026-15679. The advisory lists numerous CVEs affecting the Red Hat AI Inference Server but does not provide details on specific vulnerabilities or fixes. No patches or remediation steps are currently available as per the vendor advisory.
Red Hat AI Inference Model Optimization Tools 3.4.6 (cuda) has been identified with multiple security vulnerabilities. The advisory lists several CVEs affecting this product, but no fixes or patches are currently provided. The vulnerabilities include issues related to path traversal, improper certificate validation, and code injection among others. The vendor has published an advisory but does not indicate any available remediation at this time.