Vendor
Red Hat vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 869 vulnerabilities in Red Hat: 32 in the last 7 days and 250 in the last 90 days, 93 of them critical and 11 exploited in the wild. The most recent, CVE-2026-86322, was published on 12 November 2026. 87 vulnerabilities in the last four weeks, down 24% on the four before (115). 4 critical against 8. 74 technologies have a page of their own.
- Last 7 days
- 32
- Last 90 days
- 250
- Critical, all time
- 93
- Exploited in the wild
- 11
About Red Hat
American open source software company providing Linux, virtualization, and enterprise solutions.
Red Hat technologies
- Red Hat Enterprise Linux 9146
- Red Hat Enterprise Linux 10140
- Red Hat Enterprise Linux 8132
- Red Hat Keycloak102
- Red Hat Enterprise Linux 768
- Red Hat Enterprise Linux 656
- Red Hat Build of Keycloak55
- Red Hat Enterprise Linux AppStream46
- Red Hat Ansible Automation Platform44
- Red Hat OpenShift Container Platform 436
- Red Hat Developer Hub28
- Red Hat Quay20
- Red Hat Multicluster Global Hub19
- Red Hat OpenShift AI18
- Red Hat OpenShift Container Platform17
- Red Hat AI Inference Server16
- Red Hat Enterprise Linux AI15
- Red Hat Enterprise Linux15
- Red Hat Enterprise Linux 9.014
- Red Hat Self-service automation portal14
- Red Hat Advanced Cluster Security for Kubernetes12
- Red Hat Self-Service Automation Portal 212
- Red Hat SSSD11
- Red Hat WildFly11
- Red Hat Enterprise Linux 10.010
- Red Hat Enterprise Linux 8.010
- Red Hat Foreman9
- Red Hat Trusted Artifact Signer9
- Red Hat 389-Ds-Base8
- Red Hat streams for Apache Kafka8
- Red Hat OpenShift Lightspeed7
- Red Hat Lightspeed Core6
- Red Hat build of Apache Camel for Spring Boot6
- Red Hat Single Sign-On 76
- Red Hat Build of Apache Camel for Quarkus5
- Red Hat Clevis5
- Red Hat Cockpit Machines5
- Red Hat Enterprise Linux 7.05
- Red Hat Enterprise-Linux-Appstream-Eus5
- Red Hat Fuse 75
- Red Hat Katello5
- Red Hat Build of Podman Desktop5
- Red Hat Satellite5
- Red Hat WildFly Core5
- Red Hat ABRT4
- Red Hat AMQ Broker4
- Red Hat Ansible-Core4
- Red Hat Apicurio-Registry4
- Red Hat Data Grid 84
- Red Hat Enterprise Application Platform4
- Red Hat Gfs2-Utils4
- Red Hat Gstreamer-Plugins-Good4
- Red Hat Hawtio-Operator4
- Red Hat In-Vehicle Operating System 14
- Red Hat OpenShift4
- Red Hat Quarkus4
- Red Hat RESTEasy4
- Red Hat Ansible Lightspeed extension for Visual Studio Code3
- Red Hat build of Debezium3
- Red Hat Podman Desktop3
- Red Hat Certificate System3
- Red Hat Connectivity Link3
- Red Hat Cost Management Metrics Operator3
- Red Hat GNOME Remote Desktop3
- Red Hat Gstreamer-Plugins-Bad-Free3
- Red Hat Infinispan3
- Red Hat JBoss EAP3
- Red Hat Oc-Mirror3
- Red Hat OpenShift Container Platform 4.03
- Red Hat Openshift-Data-Foundation3
- Red Hat PipeWire3
- Red Hat Polkit3
- Red Hat AWX3
- Red Hat Red-Hat-Enterprise-Linux-Server3
Latest Red Hat vulnerabilities
- CVE-2026-86322: Foreman authorization bypass in personal access token creationhighCVSS 8.8
- CVE-2026-111456: Candlepin authorization bypass in consumer registrationhighCVSS 7.1
- CVE-2026-107152: Foreman smart_proxy_dynflow improper authentication in task consolehighCVSS 7.1
- CVE-2026-71363: Red Hat AWX unauthenticated debug API accessmediumCVSS 5.3
- CVE-2026-127100: SSSD PAM responder NULL pointer dereference in JSON extensionmediumCVSS 5.5
- CVE-2026-127099: SSSD stack buffer overflow in X.509 RSA certificate conversionmediumCVSS 5.9
- CVE-2026-121876: systemd-gpt-auto-generator credential disclosure in OpenShift Sandboxed ContainershighCVSS 7.9
- CVE-2026-71367: AWX WebSocket consumer incorrect authorizationmediumCVSS 4.3
- CVE-2026-126643: Red Hat Ansible Automation Platform cleartext storage of resource-server secretmediumCVSS 6.5
- CVE-2026-126642: Red Hat Ansible Automation Platform AWX authorization bypass in webhook credentialsmediumCVSS 6.5
- CVE-2026-110697: Red Hat Quay SQL injection in robot account listingcriticalCVSS 9.9
- CVE-2026-123710: Red Hat Quay unauthenticated service key takeovercriticalCVSS 9.8
- CVE-2026-116468: Red Hat Keycloak missing authorization check in group reparentingmediumCVSS 6.6
- CVE-2026-123084: Pulpcore expression language injection in content guardmediumCVSS 6.5
- CVE-2026-125672: Cockpit-storaged curl option injection via Tang keyservermediumCVSS 6.6
- CVE-2026-12977: WildFly Core deployment handler privilege escalationhighCVSS 8.8
- CVE-2026-84503: Red Hat ansible-core git module argument injectionmediumCVSS 6.7
- CVE-2026-19706: Red Hat OpenShift Agent-Based Installation privilege escalation in CSR approvalhighCVSS 8.3
- CVE-2026-125063: Red Hat Ansible Automation Platform automation controller ReDoS in rrule validationmediumCVSS 4.3
- CVE-2026-93879: Hibernate Validator expression language injection in validatorshighCVSS 7.5
- CVE-2026-120984: Keycloak server arbitrary code execution in client authorizationcriticalCVSS 9.1
- CVE-2026-83495: Red Hat Trainer v2 TrainJob API secret injection privilege escalationinfo
- CVE-2026-50240: Red Hat OpenShift Pipelines-as-Code privilege escalation in Repository creationhighCVSS 8.8
- CVE-2026-9797: Keycloak privilege escalation via client authentication manipulationmediumCVSS 6.5
- CVE-2026-83494: Red Hat training-operator immutability bypass in PyTorchJob webhookinfo
Most severe Red Hat vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2017-12149: Red Hat JBoss Application Server Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2010-1871: Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2023-4911: GNU C Library Buffer Overflow Vulnerabilitycriticalexploited in the wildCVSS 7.8
- CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerabilitycriticalexploited in the wildCVSS 7.8
- CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerabilitycriticalexploited in the wildCVSS 7.8
- CVE-2010-1428: Red Hat JBoss Information Disclosure Vulnerabilitycriticalexploited in the wildCVSS 7.5
- CVE-2015-5287: Red Hat ABRT privilege escalation via symlink attackcriticalexploited in the wildCVSS 7EPSS 5.0%
- CVE-2026-53362: Linux Kernel buffer overflow in IPv6 paged allocationcriticalexploited in the wildCVSS 6.2EPSS 0.7%
- CVE-2010-0738: Red Hat JBoss Authentication Bypass Vulnerabilitycriticalexploited in the wildCVSS 5.3
- CVE-2018-14667: Richfaces vulnerable to arbitrary code executioncriticalexploited in the wildCVSS 3.1EPSS 74.2%
Vulnerabilities per week
87 vulnerabilities in the last four weeks, down 24% on the four before (115). 4 critical against 8. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 5 | 3 | |
| 24 Aug 2026 | 8 | 2 | |
| 31 Aug 2026 | 7 | 0 | |
| 7 Sep 2026 | 9 | 1 | |
| 14 Sep 2026 | 24 | 1 | |
| 21 Sep 2026 | 42 | 4 | |
| 28 Sep 2026 | 18 | 3 | |
| 5 Oct 2026 | 31 | 0 | |
| 12 Oct 2026 | 20 | 1 | |
| 19 Oct 2026 | 16 | 0 | |
| 26 Oct 2026 | 18 | 1 | |
| 2 Nov 2026 | 33 | 2 | |
| 9 Nov 2026 | 19 | 2 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Red Hat vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/red-hat)<a href="https://junglewise.ai/threats/vendors/red-hat"><img src="https://junglewise.ai/threats/vendors/red-hat/badge.svg" alt="Red Hat vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/red-hat.json, and this page as text at https://junglewise.ai/threats/vendors/red-hat.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Red Hat vulnerabilities", https://junglewise.ai/threats/vendors/red-hat, 13 November 2026.