Security
فارسی
All products

Red Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator

Red Hat · Package
16 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tagsCVE-2026-126066 · GHSA-474X-HRWR-FGX4 fast-xml-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Low Fix reported
deepmerge mergeObject() allows prototype poisoning of returned objectsCVE-2026-93753 · GHSA-GCQX-W48M-W2H4 deepmergeCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Low No fix reported
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110306 · GHSA-W74X-V6F9-J3XG fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110095 · GHSA-XHQ7-XMQJ-769H fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Low Fix reported
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110180 · GHSA-WJR9-J795-JXCR fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesCVE-2026-110725 · GHSA-333X-W4R6-6CRP fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Low Fix reported
Zod can exhaust memory while validating oversized constrained collectionsCVE-2023-54404 · GHSA-MRHX-C7XC-M3W5 zodAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 npmRed Hat High Fix reported
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
qs array-limit bypass via bracket-key comma parsingCVE-2026-82562 · GHSA-X5FP-WJ9C-MXMX qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 npmRed Hat Medium Fix reported
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksCVE-2026-69198 · GHSA-4XRF-JV44-H6HH ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetCVE-2026-69153 · GHSA-FXQJ-RQCC-2CMP postcssCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
Axios: Prototype pollution gadgets can alter axios request constructionCVE-2026-67316 · GHSA-MMX7-HFXF-JPPX axiosCryostat 4/axios npmRed Hat Medium Fix reported
adm-zip extraction follows destination symlinks, allowing arbitrary file overwriteCVE-2026-76845 · GHSA-VWC7-R8MQ-G2X9 adm-zipRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/volsync-operator-bundle npmRed Hat Medium No fix reported
open: open: Arbitrary code execution via crafted URLsCVE-2026-119025 Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9Node HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 Red Hat High No fix reported
json-schema-library: json-schema-library: Remote Prototype Pollution VulnerabilityCVE-2026-16008 Red Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgetsRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator Red Hat Medium No fix reported
qs: qs: Query parameter injection via unencoded empty array keysCVE-2026-110910 Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9Cost Management On Premise/costmanagement/costmanagement-ui-rhel10 Red Hat Low No fix reported