What’s Vulnerable › Products
Red Hat Enterprise Linux 6 vulnerabilities
89 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 78 published in the last 12 months.
Check whether your Red Hat Enterprise Linux 6 version is affected
Latest Red Hat Enterprise Linux 6 vulnerabilities
- CVE-2026-119842 — Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check (CVSS 6.5)
- CVE-2026-93009 — Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder (CVSS 4.3)
- CVE-2026-93010 — Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check (CVSS 4.3)
- CVE-2026-93006 — Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content (CVSS 6.8)
- CVE-2026-93007 — Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation (CVSS 5.3)
- CVE-2026-93011 — Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms (CVSS 5.3)
- CVE-2026-93008 — Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations (CVSS 6.8)
- CVE-2026-85498 — Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow (CVSS 3.5)
- CVE-2026-17591 — Libarchive: libarchive: use-after-free via aliased mac metadata copy (CVSS 3.6)
- CVE-2026-85977 — Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding (CVSS 5.3)
- CVE-2026-85231 — Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding (CVSS 6.5)
- CVE-2026-105958 — Spice-server: spice: heap oob read/write via unchecked migration data offsets (CVSS 7.5)
- CVE-2026-105959 — Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation (CVSS 7.5)
- CVE-2026-86476 — Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize (CVSS 8.4)
- CVE-2026-105460 — Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt() (CVSS 5.5)
- CVE-2026-108119 — Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix (CVSS 6.3)
- CVE-2026-107651 — Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader (CVSS 5.5)
- CVE-2026-101258 — Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free (CVSS 7.8)
- CVE-2026-102010 — Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if (CVSS 7.0)
- CVE-2026-94640 — Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service (CVSS 7.5)
- CVE-2026-94184 — Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01) (CVSS 5.3)
- CVE-2026-93653 — Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service) (CVSS 5.5)
- CVE-2026-92248 — Gimp: integer overflow when generating a thumbnail preview for a psd file (CVSS 7.8)
- CVE-2026-88914 — Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser (CVSS 4.4)
- CVE-2026-88924 — Gvfs: gvfs-admin socket ownership race permits local root (CVSS 7.0)