Red Hat, Inc.
First CVE: Dec 31, 2002Active for: 24 years
11,184
CVEs Published
More CVEs Published than 99% of tracked CNAs
447.4
Avg CVEs / Year
More Avg CVEs / Year than 97% of tracked CNAs
6.1
Avg CVSS Score
Higher Avg CVSS Score than 10% of tracked CNAs
0.3%
In CISA KEV
Higher KEV Rate than 81% of tracked CNAs
Self-Reporting Analysis
Of all the CVEs published by Red Hat, Inc. as a CNA, 27.9% affect products that Red Hat, Inc. develops as a vendor.
27.9%
72.1%
Self-reported: 3,121Third-party: 8,063
Of all the CVEs published that affect products developed by Red Hat, Inc., 51.6% are self-published by Red Hat, Inc. as a CNA.
51.6%
48.4%
Self-published: 3,121Published by other CNAs: 2,922
Trends Over Time
The number and severity of CVEs published by Red Hat, Inc. over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2002
23 years ago
Most Recent CVE
Jul 23, 2026
1 day ago
Top CVEs
All CVEs published by Red Hat, Inc. as a CNA, regardless of affected vendor or product.
11,184 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-4437CRITICAL Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access rest | Jun 7, 2016 | 9.8 | 99 | YES | YES |
CVE-2016-3088CRITICAL The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. | Jun 1, 2016 | 9.8 | 99 | YES | YES |
CVE-2014-0160HIGH The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive inform | Apr 7, 2014 | 7.5 | 99 | YES | YES |
CVE-2013-2251CRITICAL Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: p | Jul 20, 2013 | 9.8 | 99 | YES | YES |
CVE-2023-4911HIGH A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to us | Oct 3, 2023 | 7.8 | 98 | YES | YES |
CVE-2022-0847HIGH A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux ker | Mar 10, 2022 | 7.8 | 98 | YES | YES |
CVE-2021-4034HIGH A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pri | Jan 28, 2022 | 7.8 | 98 | YES | YES |
CVE-2019-10149CRITICAL A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command exec | Jun 5, 2019 | 9.8 | 98 | YES | YES |
CVE-2017-12149CRITICAL In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does | Oct 4, 2017 | 9.8 | 98 | YES | YES |
CVE-2017-7494CRITICAL Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writ | May 30, 2017 | 9.8 | 98 | YES | YES |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA11,184 CVEs
9%
56%
30%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local1,952 (17.5%)
Network3,483 (31.1%)
Unknown5,596 (50.0%)
Physical63 (0.6%)
Adjacent Network90 (0.8%)
Attack Complexity
Low4,803 (42.9%)
High785 (7.0%)
Unknown5,596 (50.0%)
User Interaction
None4,443 (39.7%)
Unknown5,596 (50.0%)
Required1,145 (10.2%)
Privileges Required
Low2,287 (20.4%)
High428 (3.8%)
None2,873 (25.7%)
Unknown5,596 (50.0%)
Exploit Exposure
Signals from CVEs in this cna scope (11184 CVEs).
CISA KEV
30 CVEs
0.3% of CVEs· 81st percentile
Metasploit
156 CVEs
1.4% of CVEs· 89th percentile
Nuclei
40 CVEs
0.4% of CVEs· 73rd percentile
ExploitDB
688 CVEs
6.2% of CVEs· 97th percentile
Social Chatter
An overview of all social media posts that mention a CVE ID published by Red Hat, Inc. as a CNA.
Media Mentions
Media articles that mention a CVE ID published by Red Hat, Inc. as a CNA — matched by CVE ID, not by organization name.