Known vulnerabilities in Red Hat Enterprise Linux 9

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-97024	Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc	7.1 High	Sep 29, 2026
CVE-2026-97027	Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files	3.6 Low	Sep 28, 2026
CVE-2026-97026	Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path	3.9 Low	Sep 28, 2026
CVE-2026-97025	Flatpak: flatpak: world-readable oci authentication token in system-helper cache path	3.2 Low	Sep 28, 2026
CVE-2026-102010	Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if	7.0 High	Sep 28, 2026
CVE-2026-97023	Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin	7.1 High	Sep 28, 2026
CVE-2026-96284	Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following	2.5 Low	Sep 27, 2026
CVE-2026-96282	Flatpak: flatpak: extension metadata path traversal file existence oracle	3.1 Low	Sep 27, 2026
CVE-2026-96283	Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull	3.3 Low	Sep 27, 2026
CVE-2026-96281	Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes	6.2 Medium	Sep 27, 2026
CVE-2026-96280	Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems	7.5 High	Sep 27, 2026
CVE-2026-96279	Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks	6.5 Medium	Sep 27, 2026
CVE-2026-93834	Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape	8.8 High	Sep 25, 2026
CVE-2026-95521	Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm	7.8 High	Sep 24, 2026
CVE-2026-95519	Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)	7.8 High	Sep 24, 2026
CVE-2026-97185	Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file	7.8 High	Sep 24, 2026
CVE-2026-96889	Librsvg: use-after-free when xml includes have duplicated entities	7.8 High	Sep 23, 2026
CVE-2026-96546	Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader	2.5 Low	Sep 23, 2026
CVE-2026-96545	Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader	4.4 Medium	Sep 23, 2026
CVE-2026-96541	Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline	7.5 High	Sep 23, 2026
CVE-2026-96276	Flatpak: flatpak: arbitrary write in host context via flatpak build-init	6.5 Medium	Sep 23, 2026
CVE-2026-96275	Flatpak: flatpak: arbitrary write access as root via extra-data extraction	8.8 High	Sep 23, 2026
CVE-2026-96512	A flaw was found in sudo	7.8 High	Sep 23, 2026
CVE-2026-96442	Emacs: emacs: arbitrary code execution in flymake mode	7.8 High	Sep 23, 2026
CVE-2026-13087	A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in…	8.8 High	Sep 22, 2026

Other Red Hat products