Security
فارسی
All products

Red Hat OpenShift Dev Spaces/devspaces/openvsx-rhel9

Red Hat · Package
185 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind MavenRed Hat Medium Fix reported
minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsCVE-2026-109829 · GHSA-4W7W-5XRC-9H26 undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat High Fix reported
undici vulnerable to TLS certificate validation bypass via dropped tls options in AgentCVE-2026-109383 · GHSA-2M5V-PCH6-74HX undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat High Fix reported
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationCVE-2026-87018 · GHSA-QRXM-FQHP-JWVM undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat High Fix reported
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-109932 · GHSA-9FM3-97PX-RJF6 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorCVE-2026-87029 · GHSA-55WC-3PG8-JFW6 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocationCVE-2026-102554 · GHSA-XXPH-C9WW-HJ94 com.google.guava:guavaExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 MavenRed Hat High Fix reported
undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsCVE-2026-109869 · GHSA-XJJ6-F33Q-929C undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat High Fix reported
undici vulnerable to Denial of Service via unbounded memory in the EventSource parserCVE-2026-109924 · GHSA-4QV8-2P9J-2685 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensCVE-2026-109841 · GHSA-F72V-6W45-Q472 undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110306 · GHSA-W74X-V6F9-J3XG fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110095 · GHSA-XHQ7-XMQJ-769H fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Low Fix reported
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110180 · GHSA-WJR9-J795-JXCR fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesCVE-2026-110725 · GHSA-333X-W4R6-6CRP fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Low Fix reported
Vite: Cross origin script execution through Vite custom middlewareCVE-2026-112945 · GHSA-9JRQ-W75R-8GCW vite-plusvite npmRed Hat Low Fix reported
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`CVE-2026-112947 · GHSA-VFPM-58RQ-9QCG vite-plusvite npmRed Hat Medium Fix reported
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineCVE-2026-112946 · GHSA-RQ7H-C2JC-7F22 vite-plusvite npmRed Hat Medium Fix reported