How we build.
How Red Hat hardens, tests, and signs product code.
Secure development ->
Red Hat
Product Security Center
Hello! You can ask ProdSec AI questions like the following, anytime:
Red Hat Product Security Center
Search Red Hat security advisories and CVE data, or integrate our feeds into your tools. Explore our vulnerability process or report a flaw using the links below.
Prefer a tool? For scanners and APIs|Product Security MCP
Hybrid Cloud Console shows how all of your registered systems are affected by CVEs.
1
System with known exploit
CVE-12345
Hybrid Cloud Console shows how all registered systems are affected by CVEs.
How we respond.
How we categorize, fix, and tell you about flaws in Red Hat products.
Vulnerability management ->How to report.
How to contact secalert and what happens after you send a report.
Coordinated disclosure ->Red Hat CVE Database
Find CVEs by product, severity, and more.
Log in to HCC to see how your systems are impacted by CVEs.
1
System with known exploit
CVE-12345
Hybrid Cloud Console shows how all registered systems are affected by CVEs.
| CVE | Description | Severity i | Bulletin | Remediation | Public date |
|---|
CVE
7.8
CVSS v3 Score Breakdown
Are my systems vulnerable?
Instantly access your connected infrastructure with Red Hat Lightspeed.
Description
Related security advisories
Related errata
The errata is the packaged release you apply. The advisory is the write-up.
Red Hat Security Advisories
Security advisories (RHSA) are the published write-ups for security fixes. This is not the full errata catalog. Bug-fix and enhancement errata live under Errata.
| Advisory | Synopsis | Severity | Products | Issued |
|---|
Red Hat Product Errata
Errata are the packaged releases. Type can be Security (RHSA), Bug Fix (RHBA), or Enhancement (RHEA). A security advisory is only the RHSA write-up. Come here when you need the update you apply, including non-security errata.
| Advisory | Synopsis | Type | Severity | Products |
|---|
Product Security Center / How we build
Secure development
SDL overview. This is the only page in How we build. It is about how Red Hat builds, hardens, tests, and signs product code.
Live destination: access.redhat.com/articles/red_hat_sdl
Response and disclosure do not belong on this page. Use Vulnerability management for how we respond.
Product Security Center / How we respond
Vulnerability management
How we categorize, fix, and tell you about flaws in Red Hat products. Whitepaper and video stay here.
Security update policy
Customer rules for when security updates exist and how long they stay available.
Open policy ->Product life cycles
When a product still gets fixes. This is not how you analyze a CVE. Parked here, not as a Center card.
Open product life cycles ->How we escalate
Incident response plan. Child of this story, not a sibling of CVE.
Open plan ->Publications
Risk reports and related Product Security publications.
Open publications ->Product Security overview
Parked under this story as the leftover dump, then redirect here rather than keep it as a peer.
Open overview ->Learn
Security labs and the vulnerability walkthrough.
Open labs ->Product Security Center / How to report
Coordinated disclosure
How to contact secalert and what happens after you send a report. This is the researcher page. One article.
Live destination: access.redhat.com/articles/red-hat-coordinated-vulnerability-disclosure
Product Security Center / Lifecycle Update Policy
Lifecycle security update policy
Customer rules for when security updates exist and how long they stay available.
Live destination: access.redhat.com/security/lifecycle-security-update-policy
This is not the product life cycle date hub. Product windows live on Product life cycles.
Product Security Center / Vulnerability management / Product life cycles
Product life cycles
When a product is in Full Support, Maintenance, or Extended Life. Closest to vulnerability management when the question is whether a product still gets fixes.
Live destination: access.redhat.com/product-life-cycles/update_policies
Product Security Center / Get the data
Get the data without this page
CVE Database, Security Advisories, and Errata stay in the masthead for people who want the GUI. These two paths pull the same records into a tool.
Feeds
For scanners and APIs
CSAF, VEX, OVAL, SBOM, and related files for scanners and scripts.
Open security data ->Client
Product Security MCP
Connect an agent or MCP client instead of searching this GUI. Query CVEs, advisories, and errata from the tool you already use.
Open MCP ->Product Security Center / Get the data / For scanners and APIs
For scanners and APIs
Machine-readable feeds for scanners and automation. This is not the Product Security MCP. Use Product Security MCP if you want a client instead of files.
Live destination: access.redhat.com/security/data
- CSAF / VEX documents
- OSV records
- SBOM documents
- OVAL definitions
- RHSA RSS feed
Product Security Center / Lightwell
Lightwell
Placeholder for the Lightwell story. The home card is a nudge. This page is where Learn more about Lightwell lands in the mock.
Red Hat and IBM stay as partners on the card. Hybrid Cloud Console stays the path for registered systems. Lightwell is a separate offer next to that box, not a replacement for CVE search.
Product Security Center / Get the data / Product Security MCP
Product Security MCP
Skip this website. Connect a Model Context Protocol client and query the same CVE, advisory, and errata records the GUI shows.
This is an alternative to searching the CVE database, Security Advisories, and Errata in the browser. It is not a replacement for Hybrid Cloud Console, which is about your registered systems.
What a client can ask
- Find a CVE and its Red Hat severity
- List security advisories for a product
- Return the related errata you apply
- Point to a bulletin when a CVE is covered by one
What it will not do
- It will not disclose embargoed issues
- It will not replace secalert reporting
- It will not replace scanner feeds. Those stay on For scanners and APIs
Setup
Placeholder for endpoint, authentication, and a short example prompt. Wire this when the MCP is real. For this mock, treat it as the specialist page the home search line and References both open.
Product Security Center / Learn
Learn
SSH Vulnerability Helper
This application helps fix/mitigate SSH vulnerabilities in Red Hat Enterprise Linux.
Go to App ->Red Hat Product Errata Advisory Checker
This application helps you retrieve information of Red Hat Product Errata. It supports filtering errata advisories by type or product, retrieving all errata advisories within a selected date range, and saving them into a CSV file.
Go to App ->Red Hat CVE Checker
This application helps you retrieve information for multiple CVEs which are affecting any currently supported Red Hat product by uploading a plain text file containing comma-separated CVE IDs, searching by date range, or through user input.
Go to App ->Product Security Center / Vulnerability management / Incident response plan
Incident response plan
How we escalate. When PSIRT declares Minor, Exploit, or Major. Nested under Vulnerability management.
Live destination: access.redhat.com/security/vulnerability-management-lifecyle
Product Security Center / Understanding severity ratings
Understanding severity ratings
Red Hat rates issues on a four-point scale: Low, Moderate, Important, and Critical. CVSS is extra guidance. Red Hat does not use CVSS alone to set this rating.
Live destination: access.redhat.com/security/updates/classification
This page is help next to the Severity column. It is not a hub destination.
Product Security Center / Security glossary
Security glossary
A reference list for the whole Product Security Center. Not a secure-development, vulnerability-management, or disclosure page.
Live destination: access.redhat.com/security/glossary
Product Security Center / Security blog
Security blog
A feed. Posts jump across build, respond, and report. Keep it in References, not as a fourth home card.
Live destination: redhat.com/en/blog/channel/security
Product Security Center / Vulnerability management / Product Security overview
Product Security overview
This page mixes leftover topics. Park it under Vulnerability management, then redirect here rather than keep it as a peer of the Center.
Live destination: access.redhat.com/security/overview
Product Security Center / Product Security publications
Product Security publications
Risk reports and related publications.
Live destination: access.redhat.com/security/publications
Product Security Center / Security Advisories / Bulletins /
Bulletin
Related CVEs
Related security advisories
These are the write-ups. Apply the matching errata on the Errata page.
Advisory
This page is the security advisory write-up. The packaged release is on Errata.
// Related prototype: remediating CVEs with Red Hat agents in your AI IDE