Red Hat Enterprise Linux 10.0 Extended Update Support
127 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Red Hat Enterprise Linux 10.0 Extended Update Support, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Red Hat Enterprise Linux 10.0 Extended Update Support CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 2 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 1 |
| 2025-10 | 1 |
| 2025-11 | 5 |
| 2025-12 | 3 |
| 2026-01 | 2 |
| 2026-02 | 6 |
| 2026-03 | 7 |
| 2026-04 | 10 |
| 2026-05 | 20 |
| 2026-06 | 35 |
| 2026-07 | 14 |
| 2026-08 | 13 |
| 2026-09 | 5 |
Severity
How the 127 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical5
- High85
- Medium34
- Low3
Latest CVEs
The 15 most recently published vulnerabilities affecting Red Hat Enterprise Linux 10.0 Extended Update Support.
- CVE-2026-18922389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property9.8
- CVE-2026-18453389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search7.5
- CVE-2026-18355389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()7.5
- CVE-2026-76560389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn7.5
- CVE-2026-81665Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly7.5
- CVE-2026-18917Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow7.8
- CVE-2026-19654Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd7.5
- CVE-2026-73433Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write6.6
- CVE-2026-73434Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing6.1
- CVE-2026-63622Libvirt: swtpm privilege escalation via symlink following7.8
- CVE-2026-19389Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read7.1
- CVE-2026-19387Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder7.6
- CVE-2026-15816Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()7.5
- CVE-2026-7867Udisks2: udisks2: local privilege escalation via as-user option spoofing7.8
- CVE-2026-18649Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders7.5
Product grouping is registry-driven, with AI assist and human review. How it works