Red Hat Enterprise Linux Tus vulnerabilities

25 CVEs affecting Red Hat Enterprise Linux Tus, 4 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-31431, published 2026-04-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-5195: Linux Kernel Race Condition Vulnerability, published 2016-11-10. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 83.5% chance of exploitation in the next 30 days. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a…
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability, published 2026-04-09. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-08-04. EPSS: 6.6% chance of exploitation in the next 30 days. Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20,…
CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability, published 2026-04-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-05-01. EPSS: 3.4% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the…
CVE-2025-31277: Apple Multiple Products Buffer Overflow Vulnerability, published 2025-07-30. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-03-20. EPSS: 1.6% chance of exploitation in the next 30 days. The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously…
CVE-2019-9948, published 2019-03-23. Critical severity, CVSS 9.1. EPSS: 11.8% chance of exploitation in the next 30 days. urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by…
CVE-2017-15041, published 2017-10-05. Critical severity, CVSS 9.8. EPSS: 9.3% chance of exploitation in the next 30 days. Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but…
CVE-2014-4341, published 2014-07-20. Medium severity, CVSS 5.0. EPSS: 7.1% chance of exploitation in the next 30 days. MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.
CVE-2020-1045, published 2020-09-11. High severity, CVSS 7.5. EPSS: 5.9% chance of exploitation in the next 30 days. <p>A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.</p> <p>The ASP.NET Core cookie parser decodes entire cookie strings which could allow…
CVE-2020-2590, published 2020-01-15. Low severity, CVSS 3.7. EPSS: 3.2% chance of exploitation in the next 30 days. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:…
CVE-2021-3570, published 2021-07-09. High severity, CVSS 8.8. EPSS: 3% chance of exploitation in the next 30 days. A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or…

Latest

CVE-2025-62230, published 2025-10-30. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related…
CVE-2025-62231, published 2025-10-30. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends…
CVE-2024-3183, published 2024-06-12. High severity, CVSS 8.1. EPSS: 2.1% chance of exploitation in the next 30 days. A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force…
CVE-2024-0229, published 2024-02-09. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to…
CVE-2023-4806, published 2023-09-18. Medium severity, CVSS 5.9. EPSS: 1.6% chance of exploitation in the next 30 days. A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable…
CVE-2023-4527, published 2023-09-18. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger…
CVE-2021-20316, published 2022-08-23. Medium severity, CVSS 6.8. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share metadata, to perform this operation outside of…