Security
فارسی
All products

Red Hat Trusted Artifact Signer/rhtas/rhtas-console-ui-rhel9

Red Hat · Package
45 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileCVE-2026-112948 · GHSA-P458-7748-MCP3 @vitest/browser@vitest/ui npmRed Hat Medium Fix reported
Vitest: Code injection via unauthenticated manual mock registrationCVE-2026-112949 · GHSA-QXG6-89MG-RQV8 @vitest/mockerRed Hat AMQ Broker 7/amq-broker-bin.zip npmRed Hat Medium Fix reported
Vite: Cross origin script execution through Vite custom middlewareCVE-2026-112945 · GHSA-9JRQ-W75R-8GCW vite-plusvite npmRed Hat Low Fix reported
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`CVE-2026-112947 · GHSA-VFPM-58RQ-9QCG vite-plusvite npmRed Hat Medium Fix reported
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineCVE-2026-112946 · GHSA-RQ7H-C2JC-7F22 vite-plusvite npmRed Hat Medium Fix reported
undici vulnerable to Denial of Service via orphaned RetryHandler response bodyCVE-2026-18149 · GHSA-PMJH-FQ2X-6V4X undiciOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to downstream response splitting via retry interceptorCVE-2026-18540 · GHSA-R53P-7PC4-XJ5R undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Low Fix reported
undici vulnerable to Denial of Service via unbounded decompression of compressed responsesCVE-2026-84890 · GHSA-3XPG-4RPP-HHHM undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesCVE-2026-84933 · GHSA-2JFJ-6HJV-FM6J undiciOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to caching and replay of unsafe HTTP method responsesCVE-2026-85008 · GHSA-8436-99HF-9MMV undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Low Fix reported
undici vulnerable to response truncation via oversized chunked responses in the dump interceptorCVE-2026-84947 · GHSA-2GQQ-GQF2-X968 undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Low Fix reported
undici vulnerable to Denial of Service via WebSocketStream unclean closeCVE-2026-85014 · GHSA-RX4F-C7P8-82VQ undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Medium Fix reported
undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionCVE-2026-85024 · GHSA-3WWX-PV8P-Q78V undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 npmRed Hat Medium Fix reported
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
js-yaml: Exponential parsing time in flow collections leads to denial of serviceCVE-2026-73643 · GHSA-PM4M-PH32-GHV5 js-yamlNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat High Fix reported
React Router: Potential CSRF via PUT/PATCH/DELETE document requestsCVE-2026-53663 · GHSA-84G9-W2XQ-VCV6 @remix-run/server-runtimereact-router npmRed Hat Low Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495 · GHSA-3G43-6GMG-66JW axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported