What’s Vulnerable › Products

RedHat Enterprise Linux Eus vulnerabilities

791 known vulnerabilities, 42 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.

Check whether your RedHat Enterprise Linux Eus version is affected

Exploited RedHat Enterprise Linux Eus vulnerabilities

• CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
• CVE-2022-0492 — Linux Kernel Improper Authentication Vulnerability
• CVE-2026-31431 — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
• CVE-2025-31277 — Apple Multiple Products Buffer Overflow Vulnerability
• CVE-2014-0502 — Adobe Flash Player Double Free Vulnerablity
• CVE-2014-0497 — Adobe Flash Player Integer Underflow Vulnerablity
• CVE-2013-0648 — Adobe Flash Player Code Execution Vulnerability
• CVE-2013-0643 — Adobe Flash Player Incorrect Default Permissions Vulnerability
• CVE-2023-4911 — GNU C Library Buffer Overflow Vulnerability
• CVE-2016-3427 — Oracle Java SE and JRockit Unspecified Vulnerability
• CVE-2014-0196 — Linux Kernel Race Condition Vulnerability
• CVE-2021-4034 — Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
• CVE-2016-1646 — Google Chromium V8 Out-of-Bounds Read Vulnerability
• CVE-2015-4495 — Mozilla Firefox Security Feature Bypass Vulnerability
• CVE-2017-8291 — Artifex Ghostscript Type Confusion Vulnerability
• CVE-2019-8720 — WebKitGTK Memory Corruption Vulnerability
• CVE-2022-0847 — Linux Kernel Privilege Escalation Vulnerability
• CVE-2015-3113 — Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
• CVE-2013-2729 — Adobe Reader and Acrobat Arbitrary Integer Overflow Vulnerability
• CVE-2013-1690 — Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
• CVE-2012-2034 — Adobe Flash Player Memory Corruption Vulnerability
• CVE-2019-11043 — PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
• CVE-2017-12617 — Apache Tomcat Remote Code Execution Vulnerability
• CVE-2017-12615 — Apache Tomcat on Windows Remote Code Execution Vulnerability
• CVE-2012-1823 — PHP-CGI Query String Parameter Vulnerability

Latest RedHat Enterprise Linux Eus vulnerabilities

• CVE-2026-42169 — Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c) (CVSS 7.8)
• CVE-2026-58379 — Gimp: gimp: heap buffer overflow in read_channel_data() (CVSS 7.3)
• CVE-2026-31431 — Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability (CVSS 7.8) — exploited
• CVE-2026-39979 — jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers (CVSS 6.5)
• CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (CVSS 7.5) — exploited
• CVE-2026-21710 — (CVSS 7.5)
• CVE-2026-4775 — Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing (CVSS 7.8)
• CVE-2026-1709 — Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication (CVSS 9.8)
• CVE-2025-62230 — Xorg: xwayland: use-after-free in xkb client resource removal (CVSS 7.3)
• CVE-2025-62231 — Xorg: xmayland: value overflow in xkbsetcompatmap() (CVSS 7.3)
• CVE-2025-31277 — Apple Multiple Products Buffer Overflow Vulnerability (CVSS 8.8) — exploited
• CVE-2025-6021 — Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 (CVSS 7.5)
• CVE-2025-3155 — Yelp: arbitrary file read (CVSS 7.4)
• CVE-2025-2784 — Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content (CVSS 6.5)
• CVE-2025-1756 — MongoDB Shell may be susceptible to local privilege escalation in Windows (CVSS 7.8)
• CVE-2024-12088 — Rsync: --safe-links option bypass leads to path traversal (CVSS 7.5)
• CVE-2024-12087 — Rsync: path traversal vulnerability in rsync (CVSS 7.5)
• CVE-2024-12085 — Rsync: info leak via uninitialized stack contents (CVSS 7.5)
• CVE-2024-9676 — Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos) (CVSS 6.5)
• CVE-2024-9675 — Buildah: buildah allows arbitrary directory mount (CVSS 4.4)
• CVE-2024-6387 — Openssh: regresshion - race condition in ssh allows rce/dos (CVSS 8.1)
• CVE-2024-3183 — Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force (CVSS 8.1)
• CVE-2024-3049 — Booth: specially crafted hash can lead to invalid hmac being accepted by booth server (CVSS 5.9)
• CVE-2023-3758 — Sssd: race condition during authorization leads to gpo policies functioning inconsistently (CVSS 7.1)
• CVE-2022-24809 — net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference (CVSS 6.5)