RH
Vendor security profile94 actively exploited CVEs
Red Hat
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs1.135
Critical61
CISA KEV94
Public exploit223
Patch rate%16
Avg. CVSS6.7
12-month vulnerability rate
10
7
10
5
25
32
32
75
107
231
244
95
CVE KEV
CVE severity distribution
1.135toplam CVE
Critical61 (5%)
High472 (42%)
Medium537 (47%)
Low62 (5%)
Uncertain3 (0%)
Patch and exploitation view
%16
Verified patch
%8
CISA KEV
%20
Public exploit
142Patch available
37Partial
3Workaround
9Vendor: no patch
944Unknown
Latest vulnerabilities
6.3
CVE-2026-108119
Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix
RH
Patch status unknownEPSS %0
5.5
CVE-2026-108093
Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading
RH
Patch status unknownEPSS %0
5.5
CVE-2026-108063
Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry
RH
Patch status unknownEPSS %0
9.3
CVE-2026-107935
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
RH
Patch status unknownEPSS %0
4.0
CVE-2026-107655
Cups: null pointer dereference via embedded job ticket comments allows remote denial of service
RH
Patch status unknownEPSS %0
5.5
CVE-2026-107889
Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass
RH
Patch status unknownEPSS %0
5.5
CVE-2026-107651
Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader
RH
Patch status unknownEPSS %0
8.8
CVE-2026-89091
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
RH
Patch status unknownEPSS %0
4.3
CVE-2026-107623
Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation
RH
Patch status unknownEPSS %0
4.9
CVE-2026-107604
Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints
RH
Patch status unknownEPSS %0