Red Hat Update Infrastructure 5 vulnerabilities

32 CVEs affecting Red Hat Update Infrastructure 5, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-89091, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-12701, published 2026-07-20. Critical severity, CVSS 9.0. EPSS: 1.2% chance of exploitation in the next 30 days. A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such…
CVE-2026-33846, published 2026-05-04. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and…
CVE-2026-5260, published 2026-05-26. High severity, CVSS 8.2. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a…
CVE-2026-42015, published 2026-05-26. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when…
CVE-2026-78002, published 2026-08-27. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This…
CVE-2026-14164, published 2026-06-30. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking…
CVE-2026-6100, published 2026-04-13. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is…
CVE-2026-4111, published 2026-03-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is…
CVE-2025-14831, published 2026-02-09. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates…
CVE-2026-5419, published 2026-06-01. Low severity, CVSS 3.7. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive…

Latest

CVE-2026-89091, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation…
CVE-2026-103870, published 2026-10-07. Medium severity, CVSS 5.0. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task…
CVE-2026-103868, published 2026-10-07. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a…
CVE-2026-90959, published 2026-09-24. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to…
CVE-2026-96512, published 2026-09-23. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the…
CVE-2026-74860, published 2026-09-08. High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD)…
CVE-2026-84232, published 2026-09-01. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml…
CVE-2026-13732, published 2026-08-31. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and…
CVE-2026-16730, published 2026-07-24. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to…