Red Hat vendor intelligence
Red Hat Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting Red Hat products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 10
- Known exploited vulnerabilities affecting Red Hat products
- In CISA KEV
- 7
- Records also listed in the official catalog
- Beyond CISA KEV
- 3
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 1
- Red Hat KEV with sensor-observed exploitation activity
The catalog gap matters for Red Hat exposure
Three of the ten exploited Red Hat vulnerabilities tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss 30% of this vendor portfolio.
- 70%
- Covered by CISA
- 30%
- Beyond CISA
- 8
- Product families
Attested Red Hat vulnerabilities
10 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2015-5287
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges... |
Automatic Bug Reporting Tool (ABRT) | Confirmed | In CISA | 26 Aug 2026 |
|
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass |
Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.15, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.6, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7 | Confirmed | Beyond CISA | 25 Aug 2026 |
|
CVE-2026-4631
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection |
Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 | High | Beyond CISA | 08 Jul 2026 |
|
CVE-2010-1871
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss... |
JBoss Enterprise Application Platform | Confirmed | In CISA | 10 Dec 2021 |
|
CVE-2017-12149
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the... |
jbossas | Confirmed | In CISA | 10 Dec 2021 |
|
CVE-2010-0738
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3... |
JBoss Enterprise Application Platform | Confirmed | In CISA | 25 May 2022 |
|
CVE-2010-1428
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and... |
JBoss Enterprise Application Platform | Confirmed | In CISA | 25 May 2022 |
|
CVE-2018-14667
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote,... |
RichFaces Framework | Confirmed | In CISA | 28 Sep 2023 |
|
CVE-2023-4911
Glibc: buffer overflow in ld.so leading to privilege escalation |
, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 | Confirmed | In CISA | 21 Nov 2023 |
|
CVE-2020-10770
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter... |
Keycloak | High | Beyond CISA | 15 Dec 2020 |
No Red Hat vulnerabilities match this search or filter.
Showing 10 of 10 Red Hat known exploited vulnerabilities.
Recurring weakness patterns
Exposed dangerous method or function, deserialization, and link resolution before file access ('link following') account for four mapped occurrences across this Red Hat KEV portfolio.
CWE-749
Exposed Dangerous Method or Function
CWE-502
Deserialization of Untrusted Data
CWE-59
Improper Link Resolution Before File Access ('Link Following')
CWE-640
Weak Password Recovery Mechanism for Forgotten Password
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CWE-918
Server-Side Request Forgery (SSRF)
CWE-122
Heap-based Buffer Overflow