Linux · Security advisory · April 30, 2026
RHSA-2026:10702: Security update for 4 packages
RHSA-2026:10702, released April 30, 2026, fixes 18 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
18
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0109
65th percentile
Priority of the 18 CVEs
Patch now 0
Urgent 0
High 18
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| webkit2gtk3 | RHEL 8 | 0:2.52.3-1.el8_10 |
| webkit2gtk3-devel | RHEL 8 | 0:2.52.3-1.el8_10 |
| webkit2gtk3-jsc | RHEL 8 | 0:2.52.3-1.el8_10 |
| webkit2gtk3-jsc-devel | RHEL 8 | 0:2.52.3-1.el8_10 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2025-43214 | WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash | 8.8 | 0.0109 | None reported | |
| High | CVE-2025-43213 | libjavascriptcoregtk-bin: The issue was addressed with improved memory handling | 8.8 | 0.0078 | None reported | |
| High | CVE-2026-20664 | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0075 | None reported | |
| High | CVE-2026-20652 | WebKit: A remote attacker may be able to cause a denial-of-service | 8.8 | 0.0070 | None reported | |
| High | CVE-2026-28857 | webkit2gtk3: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgt... | 8.8 | 0.0067 | None reported | |
| High | CVE-2026-28859 | WebKit: A malicious website may be able to process restricted web content outside the sandbox | 8.8 | 0.0066 | None reported | |
| High | CVE-2026-20665 | WebKit: Processing maliciously crafted web content may prevent Content Security Policy from being enforced | 8.8 | 0.0063 | None reported | |
| High | CVE-2025-43457 | gir1.2-javascriptcoregtk-6.0: A use-after-free issue was addressed with improved memory management | 8.8 | 0.0061 | None reported | |
| High | CVE-2025-43511 | WebKit Web Inspector: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0046 | None reported | |
| High | CVE-2026-20636 | gir1.2-javascriptcoregtk-4.1: The issue was addressed with improved memory handling | 8.8 | 0.0046 | None reported | |
| High | CVE-2026-20643 | WebKit: Processing maliciously crafted web content may bypass Same Origin Policy | 8.8 | 0.0037 | None reported | |
| High | CVE-2026-20635 | gir1.2-javascriptcoregtk-4.1: The issue was addressed with improved memory handling | 8.8 | 0.0035 | None reported | |
| High | CVE-2026-20644 | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0035 | None reported | |
| High | CVE-2025-46299 | WebKit: Processing maliciously crafted web content may disclose internal states of the app | 8.8 | 0.0031 | None reported | |
| High | CVE-2026-20691 | WebKit Sandboxing: A maliciously crafted webpage may be able to fingerprint the user | 8.8 | 0.0029 | None reported | |
| High | CVE-2026-28871 | WebKit: Visiting a maliciously crafted website may lead to a cross-site scripting attack | 8.8 | 0.0029 | None reported | |
| High | CVE-2026-20608 | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0028 | None reported | |
| High | CVE-2026-20676 | WebKit: A website may be able to track users through Safari web extensions | 8.8 | 0.0027 | None reported |
Showing 1 to 18 of 18
1