| fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tagsCVE-2026-126066 · GHSA-474X-HRWR-FGX4 |
fast-xml-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkoutCVE-2026-63478 · GHSA-CW2G-2VWQ-88W6 |
isomorphic-gitOpenShift Serverless/openshift-serverless-1/logic-rhel9-operator |
npmRed Hat |
Medium
|
Fix reported |
|
| isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)CVE-2026-63475 · GHSA-96WC-2M84-2CJ7 |
isomorphic-gitOpenShift Serverless/openshift-serverless-1/logic-rhel9-operator |
npmRed Hat |
Medium
|
Fix reported |
|
| isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE)CVE-2026-63395 · GHSA-9QW7-J9XW-FV9C |
isomorphic-gitOpenShift Serverless/openshift-serverless-1/logic-rhel9-operator |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110306 · GHSA-W74X-V6F9-J3XG |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110095 · GHSA-XHQ7-XMQJ-769H |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110180 · GHSA-WJR9-J795-JXCR |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesCVE-2026-110725 · GHSA-333X-W4R6-6CRP |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| Zod can exhaust memory while validating oversized constrained collectionsCVE-2023-54404 · GHSA-MRHX-C7XC-M3W5 |
zodAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalizationCVE-2026-106460 · GHSA-XM5Q-P7W3-X6CP |
@backstage/plugin-auth-nodeRed Hat Developer Hub 1/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Denial of Service via orphaned RetryHandler response bodyCVE-2026-18149 · GHSA-PMJH-FQ2X-6V4X |
undiciOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to downstream response splitting via retry interceptorCVE-2026-18540 · GHSA-R53P-7PC4-XJ5R |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| undici vulnerable to Denial of Service via unbounded decompression of compressed responsesCVE-2026-84890 · GHSA-3XPG-4RPP-HHHM |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesCVE-2026-84933 · GHSA-2JFJ-6HJV-FM6J |
undiciOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to caching and replay of unsafe HTTP method responsesCVE-2026-85008 · GHSA-8436-99HF-9MMV |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| undici vulnerable to response truncation via oversized chunked responses in the dump interceptorCVE-2026-84947 · GHSA-2GQQ-GQF2-X968 |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| undici vulnerable to Denial of Service via WebSocketStream unclean closeCVE-2026-85014 · GHSA-RX4F-C7P8-82VQ |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionCVE-2026-85024 · GHSA-3WWX-PV8P-Q78V |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operationsCVE-2026-48988 · GHSA-6V5V-WF23-FMFQ |
markdown-itRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
Medium
|
Fix reported |
|
