Red Hat Enterprise Linux For Arm 64 Eus vulnerabilities

37 CVEs affecting Red Hat Enterprise Linux For Arm 64 Eus, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1709, published 2026-02-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability, published 2019-10-28. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.7% chance of exploitation in the next 30 days. In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space…
CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability, published 2019-04-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 65% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process…
CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability, published 2023-10-03. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-11-21. EPSS: 63.8% chance of exploitation in the next 30 days. A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously…
CVE-2024-6387, published 2024-07-01. High severity, CVSS 8.1. EPSS: 99.5% chance of exploitation in the next 30 days. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote…
CVE-2025-3155, published 2025-04-03. High severity, CVSS 7.4. EPSS: 13.1% chance of exploitation in the next 30 days. A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may…
CVE-2024-12085, published 2025-01-14. High severity, CVSS 7.5. EPSS: 8.8% chance of exploitation in the next 30 days. A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a…
CVE-2019-6470, published 2019-11-01. High severity, CVSS 7.5. EPSS: 8.8% chance of exploitation in the next 30 days. There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its…
CVE-2026-1709, published 2026-02-06. Critical severity, CVSS 9.8. EPSS: 5.8% chance of exploitation in the next 30 days. A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows…
CVE-2024-12088, published 2025-01-14. High severity, CVSS 7.5. EPSS: 4.7% chance of exploitation in the next 30 days. A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within…

Latest

CVE-2025-13601, published 2025-11-26. High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days. A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of…
CVE-2025-6021, published 2025-06-12. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a…
CVE-2025-2784, published 2025-04-03. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in…
CVE-2025-1756, published 2025-02-27. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored…
CVE-2024-12087, published 2025-01-14. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even…
CVE-2024-9676, published 2024-10-15. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of…