| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds checkCVE-2025-55159 · GHSA-QX2V-8332-M4FVVersion ranges need review. |
slabRed Hat Enterprise Linux 10/389-ds-base |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| rustls-webpki: Denial of service via panic on malformed CRL BIT STRINGCVE-2026-93599 · GHSA-82J2-J2CH-GFR8Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicCVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| tar-rs `unpack_in` can chmod arbitrary directories by following symlinksCVE-2026-33056 · GHSA-J4XF-2G29-59PHVersion ranges need review. |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Some AES functions may panic when overflow checking is enabled in ringCVE-2025-4432 · GHSA-4P46-PWFR-66X6 |
ringRed Hat Enterprise Linux 10/firefox |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| rust-openssl: rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`CVE-2025-3416 |
Red Hat Directory Server 11/redhat-ds:11/389-ds-baseRed Hat Directory Server 12/redhat-ds:12/389-ds-base |
Red Hat |
Low
|
No fix reported |
|
| glib: Buffer Under-read on GLib through glib/gfileutils.c via get_tmp_file()CVE-2025-7039 |
Red Hat Enterprise Linux 10/bootcRed Hat Enterprise Linux 10/glib2 |
Red Hat |
Low
|
No fix reported |
|
| glib: GLib: Denial of Service via Integer Overflow in g_buffered_input_stream_peek()CVE-2026-0988 |
Red Hat Enterprise Linux 10/bootcRed Hat Enterprise Linux 10/glib2 |
Red Hat |
Low
|
No fix reported |
|
| Glib: GLib: Memory corruption via integer overflow in Unicode case conversionCVE-2026-1489 |
Red Hat Enterprise Linux 10/bootcRed Hat Enterprise Linux 10/glib2 |
Red Hat |
Medium
|
No fix reported |
|
| Glib: Glib: Local denial of service via buffer underflow in content type parsingCVE-2026-1485 |
Red Hat Enterprise Linux 10/bootcRed Hat Enterprise Linux 10/glib2 |
Red Hat |
Low
|
No fix reported |
|
| Glib: Integer Overflow Leading to Buffer Underflow and Out-of-Bounds Write in GLib g_base64_encode()CVE-2026-1484 |
Red Hat Enterprise Linux 10/bootcRed Hat Enterprise Linux 10/glib2 |
Red Hat |
Medium
|
No fix reported |
|
| systemd: systemd: Privilege escalation via improper access control in RegisterMachine D-Bus methodCVE-2026-4105 |
Red Hat Enterprise Linux 10/NetworkManagerRed Hat Enterprise Linux 10/rpm-ostree |
Red Hat |
Medium
|
No fix reported |
|
| systemd: udev in systemd: Privilege escalation via malicious hardware devices and unsanitized kernel outputCVE-2026-40225 |
Red Hat Enterprise Linux 10/rpm-ostreeRed Hat OpenShift Container Platform 4/openshift/ose-rhel-coreos-8 |
Red Hat |
Medium
|
No fix reported |
|
| uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versionsCVE-2026-41988 |
Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9Confidential Cluster Operator/confidential-clusters-beta/buildroot-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| Void: Void: Sensitive file exfiltration via AI agent path traversal vulnerabilityCVE-2026-65698 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/vector-rhel9Red Hat Enterprise Linux 10/firefox |
Red Hat |
Medium
|
No fix reported |
|
| tar: tar-rs: Information Disclosure via Symlink EscapeCVE-2026-70622 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9OpenShift Lightspeed/openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
