What’s Vulnerable › Products
Red Hat Enterprise Linux 9.4 Extended Update Support vulnerabilities
79 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 41 published in the last 12 months.
Check whether your Red Hat Enterprise Linux 9.4 Extended Update Support version is affected
Latest Red Hat Enterprise Linux 9.4 Extended Update Support vulnerabilities
- CVE-2026-4802 — Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui (CVSS 8.0)
- CVE-2026-34003 — Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access (CVSS 7.8)
- CVE-2026-34001 — Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption (CVSS 7.8)
- CVE-2026-33999 — Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling (CVSS 7.8)
- CVE-2026-4111 — Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive (CVSS 7.5)
- CVE-2025-14905 — 389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow (CVSS 7.2)
- CVE-2025-14831 — Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification (CVSS 5.3)
- CVE-2026-1761 — Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response (CVSS 8.6)
- CVE-2025-14242 — Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing (CVSS 6.5)
- CVE-2026-0719 — Libsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authentication (CVSS 8.6)
- CVE-2025-14523 — Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins) (CVSS 8.2)
- CVE-2025-66287 — Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash (CVSS 8.8)
- CVE-2025-13947 — Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop (CVSS 7.4)
- CVE-2025-13502 — Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos (CVSS 7.5)
- CVE-2025-13609 — Keylime: keylime: registrar allows identity takeover via duplicate uuid registration (CVSS 8.2)
- CVE-2025-59089 — Python-kdcproxy: remote dos via unbounded tcp upstream buffering (CVSS 5.9)
- CVE-2025-59088 — Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv (CVSS 8.6)
- CVE-2025-62229 — Xorg: xmayland: use-after-free in xpresentnotify structure creation (CVSS 7.3)
- CVE-2025-11561 — Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems (CVSS 8.8)
- CVE-2025-11234 — Qemu-kvm: vnc websocket handshake use-after-free (CVSS 7.5)
- CVE-2025-7493 — Freeipa: idm: privilege escalation from host to domain admin in freeipa (CVSS 9.1)
- CVE-2025-11021 — Libsoup: out-of-bounds read in cookie date handling of libsoup http library (CVSS 7.5)
- CVE-2025-9900 — Libtiff: libtiff write-what-where (CVSS 8.8)
- CVE-2025-9566 — Podman: podman kube play command may overwrite host files (CVSS 8.1)
- CVE-2025-8067 — Udisks: out-of-bounds read in udisks daemon (CVSS 8.5)