Redhat vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-4982 A directory traversal vulnerability was discovered in Pagure server.High 7.6 · May 12, 2025
• CVE-2024-4981 A vulnerability was discovered in Pagure server.High 7.6 · May 12, 2025
• CVE-2024-51127 An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.High 7.1 · Nov 4, 2024
• CVE-2023-50387 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumptioHigh 7.5 · Feb 14, 2024
• CVE-2023-3027 The grc-policy-propagator allows security escalation within the cluster.High 7.8 · Jun 5, 2023
• CVE-2022-3787 A vulnerability was found in the device-mapper-multipath.High 7.8 · Mar 29, 2023
• CVE-2023-1380 A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel.High 7.1 · Mar 27, 2023
• CVE-2022-4492 The undertow client is not checking the server identity presented by the server certificate in https connections.High 7.5 · Feb 23, 2023
• CVE-2022-3650 A privilege escalation flaw was found in Ceph.High 7.8 · Jan 17, 2023
• CVE-2022-3259 Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.High 7.4 · Dec 9, 2022
• CVE-2022-3262 A flaw was found in Openshift.High 8.1 · Dec 8, 2022
• CVE-2022-4116 A vulnerability was found in quarkus.Critical 9.8 · Nov 22, 2022
• CVE-2022-3697 A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module.High 7.5 · Oct 28, 2022
• CVE-2022-1414 3scale API Management 2 does not perform adequate sanitation for user input in multiple fields.High 8.8 · Oct 19, 2022
• CVE-2013-4253 The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authHigh 7.5 · Oct 19, 2022
• CVE-2019-14841 A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header.High 8.8 · Oct 17, 2022
• CVE-2019-14840 A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials.High 7.5 · Oct 17, 2022
• CVE-2022-1278 A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.High 7.5 · Sep 13, 2022
• CVE-2022-2738 The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for High 7.5 · Sep 1, 2022
• CVE-2022-1902 A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes.High 8.8 · Sep 1, 2022
• CVE-2022-1319 A flaw was found in Undertow.High 7.5 · Aug 31, 2022
• CVE-2022-1259 A flaw was found in Undertow.High 7.5 · Aug 31, 2022
• CVE-2022-0084 A flaw was found in XNIO, specifically in the notifyReadClosed method.High 7.5 · Aug 26, 2022
• CVE-2021-3859 A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.High 7.5 · Aug 26, 2022
• CVE-2021-3703 It was found that the CVE-2021-27918, CVE-2021-31525 and CVE-2021-33196 have been incorrectly mentioned as fixed in RHSA for Serverless 1.16.0 and Serverless clHigh 7.5 · Aug 26, 2022