Red Hat Enterprise Linux Update Services For SAP Solutions vulnerabilities

30 CVEs affecting Red Hat Enterprise Linux Update Services For SAP Solutions, 6 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-31431, published 2026-04-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability, published 2019-04-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 65% chance of exploitation in the next 30 days. In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process…
CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability, published 2023-10-03. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-11-21. EPSS: 63.8% chance of exploitation in the next 30 days. A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously…
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability, published 2026-04-09. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-08-04. EPSS: 6.6% chance of exploitation in the next 30 days. Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20,…
CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability, published 2026-04-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-05-01. EPSS: 3.4% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the…
CVE-2025-31277: Apple Multiple Products Buffer Overflow Vulnerability, published 2025-07-30. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-03-20. EPSS: 1.6% chance of exploitation in the next 30 days. The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously…
CVE-2025-3155, published 2025-04-03. High severity, CVSS 7.4. EPSS: 13.1% chance of exploitation in the next 30 days. A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may…
CVE-2024-12085, published 2025-01-14. High severity, CVSS 7.5. EPSS: 8.8% chance of exploitation in the next 30 days. A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a…
CVE-2019-6470, published 2019-11-01. High severity, CVSS 7.5. EPSS: 8.8% chance of exploitation in the next 30 days. There had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its…
CVE-2024-12088, published 2025-01-14. High severity, CVSS 7.5. EPSS: 4.7% chance of exploitation in the next 30 days. A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within…

Latest

CVE-2025-62230, published 2025-10-30. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related…
CVE-2025-62231, published 2025-10-30. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends…
CVE-2025-2784, published 2025-04-03. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in…
CVE-2025-1756, published 2025-02-27. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored…
CVE-2025-1755, published 2025-02-27. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is…