| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdgithub.com/klauspost/compress |
GoRed Hat |
High
|
Fix reported |
|
| follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsCVE-2026-116689 · GHSA-MRWP-F3Q8-3G9P |
follow-redirectsRed Hat Hardened Images/prometheus3.5 |
npmRed Hat |
High
|
Fix reported |
|
| deepmerge mergeObject() allows prototype poisoning of returned objectsCVE-2026-93753 · GHSA-GCQX-W48M-W2H4 |
deepmergeCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
No fix reported |
|
| ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)CVE-2026-113650 · GHSA-C9RX-X947-FP3H |
sanitize-htmlCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)CVE-2026-113657 · GHSA-374F-7CHJ-9948 |
sanitize-htmlCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsCVE-2026-113661 · GHSA-CV27-6WVH-8X7J |
sanitize-htmlCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| follow-redirects array-form headers bypass cross-origin credential strippingCVE-2026-111756 · GHSA-Q3JH-WRC6-JGQ8 |
follow-redirectsRed Hat Hardened Images/prometheus3.5 |
npmRed Hat |
High
|
Fix reported |
|
| follow-redirects sensitiveHeaders regex escaping can expose credential headersCVE-2026-111755 · GHSA-8R9P-F939-6H3C |
follow-redirectsRed Hat Hardened Images/prometheus3.5 |
npmRed Hat |
High
|
Fix reported |
|
| Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compressCVE-2026-63209 · GHSA-259R-337F-4RFWVersion ranges need review. |
github.com/klauspost/compressFile Integrity Operator/compliance/openshift-file-integrity-operator-bundle |
GoRed Hat |
High
|
Fix reported |
|
| Panic parsing crafted input in x/text/secure/precis in golang.org/x/textCVE-2026-56851 · GO-2026-6629 |
golang.org/x/textRed Hat Hardened Images/golang1.25 |
GoRed Hat |
High
|
Fix reported |
|
| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSONCVE-2024-24786 · GHSA-8R3F-844C-MC37Version ranges need review. |
google.golang.org/protobuf/encoding/protojsongoogle.golang.org/protobuf/internal/encoding/json |
GoRed Hat |
Medium
|
Fix reported |
|
| source-map-js allows event-loop denial of service through indexed source-map section offsetsCVE-2026-93749 · GHSA-68FV-2MGG-JV7Q |
source-map-jsNode HealthCheck Operator/redhat-user-workloads/nhc-bundle-0-9 |
npmRed Hat |
High
|
Fix reported |
|
| moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-17495 · GHSA-4P3W-J4W9-5JQW |
momentMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDsCVE-2026-88031 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
Red Hat |
High
|
No fix reported |
|
| github.com/go-openapi/swag: go-openapi/swag: Denial of Service via uncontrolled JSON recursionCVE-2026-93450 |
Red Hat Hardened Images/opentofu1.11Red Hat Hardened Images/prometheus3.5 |
Red Hat |
High
|
No fix reported |
|
| braces: braces: Denial of Service via Stack Overflow from Deeply Nested PatternsCVE-2026-93687 |
Red Hat Hardened Images/prometheus3.5 |
Red Hat |
High
|
No fix reported |
|
| go.mongodb.org/mongo-driver: MongoDB Go Driver: Denial of Service via integer overflow in BSON processingCVE-2026-107324 |
Red Hat Hardened Images/opentofu1.11Red Hat Hardened Images/prometheus3.5 |
Red Hat |
Medium
|
No fix reported |
|
| go.mongodb.org/mongo-driver: MongoDB Go Driver: Denial of Service via malformed BSON array inputCVE-2026-107325 |
Red Hat Hardened Images/opentofu1.11Red Hat Hardened Images/prometheus3.5 |
Red Hat |
Medium
|
No fix reported |
|
