What’s Vulnerable › Products
Red Hat Enterprise Linux 7 Extended Lifecycle Support vulnerabilities
103 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 67 published in the last 12 months.
Check whether your Red Hat Enterprise Linux 7 Extended Lifecycle Support version is affected
Latest Red Hat Enterprise Linux 7 Extended Lifecycle Support vulnerabilities
- CVE-2026-114406 — Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns (CVSS 6.8)
- CVE-2026-96889 — Librsvg: use-after-free when xml includes have duplicated entities (CVSS 7.8)
- CVE-2026-96512 — Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization (CVSS 7.8)
- CVE-2026-18147 — Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url (CVSS 8.1)
- CVE-2026-18922 — 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property (CVSS 9.8)
- CVE-2026-18453 — 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search (CVSS 7.5)
- CVE-2026-18355 — 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVSS 7.5)
- CVE-2026-76560 — 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn (CVSS 7.5)
- CVE-2026-76578 — Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci (CVSS 9.8)
- CVE-2026-81665 — Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVSS 7.5)
- CVE-2026-84268 — Gvfs: sftp: heap-based buffer overflow in read_reply() (CVSS 8.8)
- CVE-2026-83596 — Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature (CVSS 8.8)
- CVE-2026-78376 — Webkitgtk: use-after-free of jscvalue function parameters (CVSS 8.8)
- CVE-2026-11861 — Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships (CVSS 8.1)
- CVE-2026-13097 — Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore (CVSS 8.7)
- CVE-2026-73197 — Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read (CVSS 7.5)
- CVE-2026-18917 — Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow (CVSS 7.8)
- CVE-2026-19550 — Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes (CVSS 8.2)
- CVE-2026-63622 — Libvirt: swtpm privilege escalation via symlink following (CVSS 7.8)
- CVE-2026-19387 — Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder (CVSS 7.6)
- CVE-2026-15816 — Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVSS 7.5)
- CVE-2026-18649 — Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders (CVSS 7.5)
- CVE-2026-16313 — Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVSS 7.6)
- CVE-2026-15588 — Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering (CVSS 5.3)
- CVE-2026-59692 — Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback (CVSS 7.5)