Red Hat Known Exploited Vulnerabilities
Evidence-backed KEV intelligence for Red Hat products — CISA KEV status, confidence, sensor telemetry, and virtual-patch availability.
Total KEVs
7
In CISA KEV
5
Beyond CISA KEV
2
Sensor Observed
0
Virtual Patch Available
0
Red Hat KEVs Added by Year
7 Red Hat KEVs added all time (primary attestation date).
Attested CVEs
| CVE | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-4631
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection |
Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 | High | Not in CISA | 08 Jul 2026 |
|
CVE-2010-1871
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss... |
JBoss Enterprise Application Platform | Confirmed | In CISA | 10 Dec 2021 |
|
CVE-2017-12149
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the... |
jbossas | Confirmed | In CISA | 10 Dec 2021 |
|
CVE-2010-0738
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3... |
JBoss Enterprise Application Platform | Confirmed | In CISA | 25 May 2022 |
|
CVE-2010-1428
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and... |
JBoss Enterprise Application Platform | Confirmed | In CISA | 25 May 2022 |
|
CVE-2023-4911
Glibc: buffer overflow in ld.so leading to privilege escalation |
, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 | Confirmed | In CISA | 21 Nov 2023 |
|
CVE-2020-10770
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter... |
Keycloak | High | Not in CISA | 15 Dec 2020 |
Common Vulnerability Classes (CWE)
- CWE-749 — Exposed Dangerous Method or Function 2
- CWE-122 — Heap-based Buffer Overflow 1
- CWE-502 — Deserialization of Untrusted Data 1
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 1
- CWE-917 — Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') 1
- CWE-918 — Server-Side Request Forgery (SSRF) 1
Browse all known exploited vulnerabilities · What is a known exploited vulnerability? · Methodology