Red Hat, Inc.

First CVE: Dec 31, 2002Active for: 24 years
11,184
CVEs Published
More CVEs Published than 99% of tracked CNAs
447.4
Avg CVEs / Year
More Avg CVEs / Year than 97% of tracked CNAs
6.1
Avg CVSS Score
Higher Avg CVSS Score than 10% of tracked CNAs
0.3%
In CISA KEV
Higher KEV Rate than 81% of tracked CNAs

Self-Reporting Analysis

Of all the CVEs published by Red Hat, Inc. as a CNA, 27.9% affect products that Red Hat, Inc. develops as a vendor.

27.9%
72.1%
Self-reported: 3,121Third-party: 8,063

Of all the CVEs published that affect products developed by Red Hat, Inc., 51.6% are self-published by Red Hat, Inc. as a CNA.

51.6%
48.4%
Self-published: 3,121Published by other CNAs: 2,922

Trends Over Time

The number and severity of CVEs published by Red Hat, Inc. over time

Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2002
23 years ago
Most Recent CVE
Jul 23, 2026
1 day ago

Top CVEs

All CVEs published by Red Hat, Inc. as a CNA, regardless of affected vendor or product.

11,184 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access rest
Jun 7, 20169.899YESYES
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
Jun 1, 20169.899YESYES
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive inform
Apr 7, 20147.599YESYES
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: p
Jul 20, 20139.899YESYES
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to us
Oct 3, 20237.898YESYES
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux ker
Mar 10, 20227.898YESYES
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as pri
Jan 28, 20227.898YESYES
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command exec
Jun 5, 20199.898YESYES
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does
Oct 4, 20179.898YESYES
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writ
May 30, 20179.898YESYES

CVE Severity & Scoring

Severity distribution of CVEs published by this CNA11,184 CVEs
Severity distribution among all CVEs352,231 CVEs
LowMediumHighCritical
Attack Vector
Local1,952 (17.5%)
Network3,483 (31.1%)
Unknown5,596 (50.0%)
Physical63 (0.6%)
Adjacent Network90 (0.8%)
Attack Complexity
Low4,803 (42.9%)
High785 (7.0%)
Unknown5,596 (50.0%)
User Interaction
None4,443 (39.7%)
Unknown5,596 (50.0%)
Required1,145 (10.2%)
Privileges Required
Low2,287 (20.4%)
High428 (3.8%)
None2,873 (25.7%)
Unknown5,596 (50.0%)

Exploit Exposure

Signals from CVEs in this cna scope (11184 CVEs).

CISA KEV
30 CVEs
0.3% of CVEs· 81st percentile
Metasploit
156 CVEs
1.4% of CVEs· 89th percentile
Nuclei
40 CVEs
0.4% of CVEs· 73rd percentile
ExploitDB
688 CVEs
6.2% of CVEs· 97th percentile

Social Chatter

An overview of all social media posts that mention a CVE ID published by Red Hat, Inc. as a CNA.

Media Mentions

Media articles that mention a CVE ID published by Red Hat, Inc. as a CNA — matched by CVE ID, not by organization name.

Top Affected Vendors

Top Affected Products

Top CWEs