Red Hat advisories

Red Hat publishes a security advisory (RHSA) for each fix it ships. This page lists the advisories that name a CVE this collection covers, taken from Red Hat's advisory list for security advisories released 2026-04-01 to 2026-11-03 (7577 advisories for 5662 CVEs). Each tool README that has any carries the same data in its own Red Hat advisories section.

How to use it: a Red Hat build is judged by its RPM release, not by the upstream version number, because Red Hat backports fixes. Find your stream and compare the installed release (rpm -q PACKAGE) with the one the advisory names. A CVE with no advisory in the list has none for that period, which is not the same as not affected. The list holds security advisories only, not bug fixes or enhancements. The current state is always on Red Hat's own pages. On a Red Hat family host with the packages installed, /opt/psf-security-patches/rhsa/rhsa.py verify --rpm makes the comparison for every installed package (man psf-rhsa).

By tool

By CVE

Source and limits

• The data is Red Hat's published advisory list, one record per advisory with its CVEs and its packages, released 2026-04-01 to 2026-11-03. Regenerate this page and the README sections from a newer list with packaging/rhsa/rhsa.py (fetch, index, then docs --write; its README says how).
• Streams are read from the release of each package (el8_10 is RHEL 8.10, hum1 is a Hummingbird build), so a stream name here is a reading of a package name, not a statement by Red Hat.
• Rebuilds of RHEL (AlmaLinux, Rocky Linux, Oracle Linux) publish their own advisories and kernels; they follow Red Hat's fixes but not on the same day or with the same ids.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.