Red Hat Enterprise Linux For Power Little Endian vulnerabilities

110 CVEs affecting Red Hat Enterprise Linux For Power Little Endian, 16 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59849, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability, published 2019-10-28. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.7% chance of exploitation in the next 30 days. In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space…
CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability, published 2017-09-19. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.6% chance of exploitation in the next 30 days. When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to…
CVE-2019-5544: VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability, published 2019-12-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.3% chance of exploitation in the next 30 days. OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base…
CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability, published 2022-01-28. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-27. EPSS: 94.9% chance of exploitation in the next 30 days. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users…
CVE-2022-0847: Linux Kernel Privilege Escalation Vulnerability, published 2022-03-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 92.8% chance of exploitation in the next 30 days. A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus…
CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.7% chance of exploitation in the next 30 days. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.3% chance of exploitation in the next 30 days. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability, published 2019-04-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 65% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process…

Latest

CVE-2026-59849, published 2026-07-21. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly…
CVE-2026-59842, published 2026-07-21. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an…
CVE-2026-15370, published 2026-07-21. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list…
CVE-2026-42009, published 2026-05-18. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS…
CVE-2026-1709, published 2026-02-06. Critical severity, CVSS 9.8. EPSS: 5.8% chance of exploitation in the next 30 days. A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows…
CVE-2025-13601, published 2025-11-26. High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days. A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of…
CVE-2025-6021, published 2025-06-12. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a…
CVE-2025-3155, published 2025-04-03. High severity, CVSS 7.4. EPSS: 13.1% chance of exploitation in the next 30 days. A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may…
CVE-2025-2784, published 2025-04-03. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in…
CVE-2024-12088, published 2025-01-14. High severity, CVSS 7.5. EPSS: 4.7% chance of exploitation in the next 30 days. A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within…