| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before useCVE-2026-102930 · GHSA-94P9-XGH2-XP45Version ranges need review. |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv: Command injection via --prompt in activate.bat (batch activator)CVE-2026-102937 · GHSA-X78J-V8H9-3J2QVersion ranges need review. |
virtualenvRed Hat Ansible Automation Platform 2/ansible-automation-platform-25/ansible-dev-tools-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injectionCVE-2026-102938 · GHSA-9H9J-4VRJ-GF7GVersion ranges need review. |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv bash and fish activation scripts execute commands embedded in pathsCVE-2026-102925 · GHSA-P58F-9548-MPM2Version ranges need review. |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Worktree operations may follow symlinksCVE-2026-71556 · GHSA-HC8V-WWC9-VGXMVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
High
|
Fix reported |
|
| BuildKit has a possible runtime DoS via unbounded group parsingCVE-2026-61712 · GHSA-72X6-4J93-7W86Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| BuildKit: Custom frontend could bypass Seccomp/AppArmorCVE-2026-61711 · GHSA-7236-3392-C5C6Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557 · GHSA-QGQ7-7HM3-Q39JVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| Docker: Race condition in docker cp allows bind mount redirection to host pathCVE-2026-42306 · GHSA-RG2X-37C3-W2RHVersion ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
High
|
Fix reported |
|
| ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository URL (e.g. --upload-pack) -> RCECVE-2026-84503 |
Migration Toolkit for Applications 8/mta/mta-rhel9-operatorMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-rhel9-operator |
Red Hat |
Medium
|
No fix reported |
|
| github.com/moby/buildkit: BuildKit: Denial of Service via duplicate Git source metadata resolutionCVE-2026-121522 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| github.com/moby/buildkit: BuildKit: Privilege escalation via unauthorized extended file attribute modificationCVE-2026-121520 |
DPU kit for NVIDIA/dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10DPU kit for NVIDIA/dpu-kit-for-nvidia/must-gather-rhel10 |
Red Hat |
High
|
No fix reported |
|
| buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerabilityCVE-2026-15789 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| github.com/moby/buildkit: BuildKit: Denial of Service via malicious client requestCVE-2026-15792 |
Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9Compliance Operator/compliance/openshift-compliance-must-gather-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| oh-my-zsh: Oh My Zsh: Arbitrary Code Execution via malicious .env filesCVE-2026-50187 |
Red Hat Ansible Automation Platform 2/ansible-automation-platform-27/ansible-devspaces-rhel9Red Hat Ansible Automation Platform 2/ansible-automation-platform-tech-preview/ansible-devspaces-rhel9 |
Red Hat |
High
|
No fix reported |
|
| github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modificationCVE-2026-75593 |
Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9Compliance Operator/compliance/openshift-compliance-must-gather-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDsCVE-2026-88031 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
Red Hat |
High
|
No fix reported |
|
