Red Hat Update Infrastructure vulnerabilities

9 CVEs affecting Red Hat Update Infrastructure, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-42055, published 2026-06-17.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-42055, published 2026-06-17. High severity, CVSS 8.1. EPSS: 6.5% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or…
• CVE-2026-9256, published 2026-05-22. High severity, CVSS 8.1. EPSS: 2.7% chance of exploitation in the next 30 days. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping…
• CVE-2023-50781, published 2024-02-05. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive…
• CVE-2023-50782, published 2024-02-05. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of…
• CVE-2026-9150, published 2026-05-20. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could…
• CVE-2026-9149, published 2026-05-21. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function.…
• CVE-2022-3644, published 2022-10-25. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
• CVE-2026-48864, published 2026-05-26. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker…
• CVE-2013-4518, published 2019-11-04. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates