Brand
Red Hat: actively exploited vulnerabilities
9 vulnerabilities in Red Hat products (JBoss Application Server / EAP, Polkit, ABRT (Automatic Bug Reporting Tool)…) are in CISA’s catalog of exploited vulnerabilities, 2 of them added in the last 90 days. Last added: August 26, 2026.
The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).
-
2 vulnerabilities added in the last 12 months
-
9 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one Red Hat category to your radar, or open its page.
- Operating systems 4 vulnerabilities
- Web and application servers 3 vulnerabilities
- Frameworks and libraries 2 vulnerabilities
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
- JBoss Application Server / EAP 3 vulnerabilities · Web servers
- Polkit 2 vulnerabilities · Operating systems
- ABRT (Automatic Bug Reporting Tool) 1 vulnerability · Operating systems
- JBoss RichFaces 1 vulnerability · Frameworks
- JBoss Seam 1 vulnerability · Frameworks
- libuser 1 vulnerability · Operating systems
Name used by CISA: Red Hat. Product families: indicative classification by this site.
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Red Hat list.
Rank 1Red Hat ABRT (Automatic Bug Reporting Tool)
CVE-2015-5287CVE from 2015, added in 2026
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
Added in the last 12 months: ranked by severity.
- Added
- Aug 26, 2026
- CISA deadline
- 14 days
- CVSS severity
- 7.8 (high)
Rank 2Red Hat libuser
CVE-2015-3246CVE from 2015, added in 2026
Red Hat Libuser Race Condition Vulnerability
Added in the last 12 months: ranked by severity.
- Added
- Aug 26, 2026
- CISA deadline
- 14 days
- CVSS severity
- 5.1 (medium)
Rank 3Red Hat JBoss RichFaces
CVE-2018-14667CVE from 2018, added in 2023
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
Added more than a year ago: ranked by severity.
- Added
- Sep 28, 2023
- CISA deadline
- 21 days
- CVSS severity
- 9.8 (critical)
Rank 4Red Hat JBoss Application Server / EAP
CVE-2017-12149RansomwareCVE from 2017, added in 2021
Red Hat JBoss Application Server Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
- Added
- Dec 10, 2021
- CISA deadline
- 182 days
- CVSS severity
- 9.8 (critical)
Rank 5Red Hat JBoss Seam
CVE-2010-1871CVE from 2010, added in 2021
Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
Added more than a year ago: ranked by severity.
- Added
- Dec 10, 2021
- CISA deadline
- 182 days
- CVSS severity
- 8.8 (high)
Rank 6Red Hat Polkit
CVE-2021-3560CVE from 2021, added in 2023
Red Hat Polkit Incorrect Authorization Vulnerability
Added more than a year ago: ranked by severity.
- Added
- May 12, 2023
- CISA deadline
- 21 days
- CVSS severity
- 7.8 (high)
Rank 7Red Hat Polkit
CVE-2021-4034Ransomware
Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
Added more than a year ago: ranked by severity.
- Added
- Jun 27, 2022
- CISA deadline
- 21 days
- CVSS severity
- 7.8 (high)
Rank 8Red Hat JBoss Application Server / EAP
CVE-2010-1428RansomwareCVE from 2010, added in 2022
Red Hat JBoss Information Disclosure Vulnerability
Added more than a year ago: ranked by severity.
- Added
- May 25, 2022
- CISA deadline
- 21 days
- CVSS severity
- 7.5 (high)
Rank 9Red Hat JBoss Application Server / EAP
CVE-2010-0738RansomwareCVE from 2010, added in 2022
Red Hat JBoss Authentication Bypass Vulnerability
Added more than a year ago: ranked by severity.
- Added
- May 25, 2022
- CISA deadline
- 21 days
- CVSS severity
- 5.3 (medium)
Follow and verify
Get new Red Hat vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).
Indicative classification, based on the vendor and product names given by CISA. How products are classified.