What is the redhat CNA?

redhat is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 10,745 CVE records since 2005.

How many CVEs has redhat published?

redhat has published 10,745 CVE records, including 588 in the last two years.

What is redhat's CVE data quality grade?

RadicalNotion.AI grades redhat's CVE data quality as F, with an overall completeness score of 26.6%. This reflects how consistently its CVE records include vendor (22.6%), product (36.8%), CVSS (16.1%), and CWE (30.9%) information.

What products does redhat publish CVEs for?

redhat most frequently publishes CVEs for Enterprise Linux, debian_linux, Linux Kernel, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8.

Which vendors does redhat cover?

redhat publishes CVEs across 565 distinct vendors, most often Red Hat, Debian, Linux, Fedora Project, Canonical.

Is redhat actively publishing CVEs?

redhat is currently active, based on 588 CVEs in the last two years.

What is the average severity of redhat's CVEs?

The average CVSS base score across redhat's scored CVEs is 6.2.

How many critical CVEs has redhat published?

redhat has published 868 critical-severity CVEs and 3,424 high-severity CVEs.

Are any of redhat's CVEs in CISA's Known Exploited Vulnerabilities catalog?

Yes. 34 of redhat's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.

What are the most common weakness types in redhat's CVEs?

redhat's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-264, CWE-20 (Improper Input Validation), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

How does redhat rank among CNAs?

By total CVE volume, redhat ranks #5 of 370 CNAs, and it reports more complete CVE records than 2% of all CNAs.

Grade F

Active

redhat

Name: redhat CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published February 11, 2026

10,745

CVEs published

Total assigned

Years active

2005–2026

6.2

Avg CVSS

Across scored CVEs

588

Recent CVEs

Last 2 years

Overview

redhat is a CVE Numbering Authority that has published 10,745 CVE records since 2005. It is currently classified as active, with 588 CVEs published in the last two years. Its CVE data quality is graded F (26.6% overall completeness).

Among the 370 CNAs tracked here, redhat ranks #5 by CVE volume and reports more complete records than 2% of all CNAs.

Data quality report card

Completeness of redhat's CVE records across vendor, product, CVSS, and CWE fields.

A CVE record needs only a description to be published. Completeness is how often redhat also fills in the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means fewer of this CNA’s CVEs need enriching by hand before you can triage them.

Report card grade

26.6%

Overall score

Overall completeness26.6%

Vendor completeness22.6%

Product completeness36.8%

CVSS completeness16.1%

CWE completeness30.9%

99.9%

Update rate

Records revised after publishing

565

Vendor diversity

Distinct vendors covered

281 chars

Avg description length

Per CVE record

2005-02-07

First CVE date

Earliest assignment

2026-02-11

Latest CVE date

Most recent assignment

6.2

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of redhat's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical868

High3,424

Medium6,555

Low1,054

In CISA’s Known Exploited Vulnerabilities catalog

34 of redhat's CVEs are confirmed exploited in the wild and carry a CISA remediation deadline.

Common weakness types

The CWE weakness categories redhat most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs redhat has published each year.

2019

630

2020

567

2021

452

2022

627

2023

446

2024

306

2025

300

2026

1,206

12-month change

Change in redhat's CVE data quality over the trailing year.

Previous grade

Current grade

Score change

22.6% → 76.7% (+54.1%)

Improved most in CVSS Completeness (+86.0 pts)

Top vendors

The vendors redhat publishes the most CVEs for.

Red Hat4,555 CVEs
Debian1,373 CVEs
Linux1,279 CVEs
Fedora Project999 CVEs
Canonical812 CVEs
Microsoft710 CVEs
Apache Software Foundation562 CVEs
openSUSE489 CVEs

Latest CVEs

The most recent CVEs assigned by redhat.

CVE-2026-89096CWE-772
Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd
Medium · CVSS 5.9
2026-10-16
CVE-2026-89088CWE-787
Parted: parted: denial of service via heap buffer overflow during fat16 resize
Medium · CVSS 5.5
2026-10-16
CVE-2026-89085CWE-787
Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image
Medium · CVSS 6.6
2026-10-16
CVE-2026-111802CWE-59
Nautilus: nautilus: arbitrary file deletion via trash symlink
Medium · CVSS 6.6
2026-10-16
CVE-2026-17591CWE-416
Libarchive: libarchive: use-after-free via aliased mac metadata copy
Low · CVSS 3.6
2026-10-16
CVE-2026-62438CWE-190
Gimp: gimp: paa integer overflow out-of-bounds read
Medium · CVSS 6.1
2026-10-16
CVE-2026-62439CWE-190
Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
High · CVSS 7.0
2026-10-16
CVE-2026-85977CWE-1050
Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding
Medium · CVSS 5.3
2026-10-16
CVE-2026-85231CWE-770
Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
Medium · CVSS 6.5
2026-10-16
CVE-2026-89098CWE-617
Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd
Medium · CVSS 5.5
2026-10-16
CVE-2026-111581CWE-88
Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method
Low · CVSS 3.3
2026-10-16
CVE-2026-111555CWE-1285
Luksmeta: missing slot-range validation permits out-of-gap device i/o
Medium · CVSS 6.0
2026-10-16

Get an alert for each new redhat CVE, with AI-written analysis and remediation steps.

Monitor redhat CVEs

Other CNAs

Data quality for other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs oracleGrade F · 8,309 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the redhat CNA.

What is the redhat CNA?: redhat is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 10,745 CVE records since 2005.
How many CVEs has redhat published?: redhat has published 10,745 CVE records, including 588 in the last two years.
What is redhat's CVE data quality grade?: RadicalNotion.AI grades redhat's CVE data quality as F, with an overall completeness score of 26.6%. This reflects how consistently its CVE records include vendor (22.6%), product (36.8%), CVSS (16.1%), and CWE (30.9%) information.
What products does redhat publish CVEs for?: redhat most frequently publishes CVEs for Enterprise Linux, debian_linux, Linux Kernel, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8.
Which vendors does redhat cover?: redhat publishes CVEs across 565 distinct vendors, most often Red Hat, Debian, Linux, Fedora Project, Canonical.
Is redhat actively publishing CVEs?: redhat is currently active, based on 588 CVEs in the last two years.
What is the average severity of redhat's CVEs?: The average CVSS base score across redhat's scored CVEs is 6.2.
How many critical CVEs has redhat published?: redhat has published 868 critical-severity CVEs and 3,424 high-severity CVEs.
Are any of redhat's CVEs in CISA's Known Exploited Vulnerabilities catalog?: Yes. 34 of redhat's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.
What are the most common weakness types in redhat's CVEs?: redhat's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-264, CWE-20 (Improper Input Validation), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
How does redhat rank among CNAs?: By total CVE volume, redhat ranks #5 of 370 CNAs, and it reports more complete CVE records than 2% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track redhat CVEs

Get an alert when this CNA publishes a new CVE, with AI-written analysis and remediation steps.

Create an account See pricing