What’s Vulnerable › Products
Red Hat Enterprise Linux 9.6 Extended Update Support vulnerabilities
112 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 108 published in the last 12 months.
Check whether your Red Hat Enterprise Linux 9.6 Extended Update Support version is affected
Latest Red Hat Enterprise Linux 9.6 Extended Update Support vulnerabilities
- CVE-2026-114406 — Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns (CVSS 6.8)
- CVE-2026-96280 — Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems (CVSS 7.5)
- CVE-2026-96889 — Librsvg: use-after-free when xml includes have duplicated entities (CVSS 7.8)
- CVE-2026-96275 — Flatpak: flatpak: arbitrary write access as root via extra-data extraction (CVSS 8.8)
- CVE-2026-96512 — Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization (CVSS 7.8)
- CVE-2026-80110 — Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint (CVSS 8.1)
- CVE-2026-92925 — Redis: redis: out-of-bounds read via crafted cluster bus packets (CVSS 7.1)
- CVE-2026-86320 — Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`) (CVSS 7.8)
- CVE-2026-75092 — Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins (CVSS 7.3)
- CVE-2026-88924 — Gvfs: gvfs-admin socket ownership race permits local root (CVSS 7.0)
- CVE-2026-18147 — Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url (CVSS 8.1)
- CVE-2026-87766 — Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVSS 8.8)
- CVE-2026-74860 — Libxml2: double-free/uaf in libxml2 python bindings (CVSS 8.5)
- CVE-2026-76561 — Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint) (CVSS 7.2)
- CVE-2026-18922 — 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property (CVSS 9.8)
- CVE-2026-18453 — 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search (CVSS 7.5)
- CVE-2026-18355 — 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVSS 7.5)
- CVE-2026-76560 — 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn (CVSS 7.5)
- CVE-2026-79678 — Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVSS 8.1)
- CVE-2026-76578 — Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci (CVSS 9.8)
- CVE-2026-81665 — Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVSS 7.5)
- CVE-2026-84268 — Gvfs: sftp: heap-based buffer overflow in read_reply() (CVSS 8.8)
- CVE-2026-83596 — Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature (CVSS 8.8)
- CVE-2026-17615 — Resteasy-core: resteasy sourceprovider remote unauthenticated file read (CVSS 7.5)
- CVE-2026-78002 — Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function (CVSS 7.5)