| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110306 · GHSA-W74X-V6F9-J3XG |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110095 · GHSA-XHQ7-XMQJ-769H |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110180 · GHSA-WJR9-J795-JXCR |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesCVE-2026-110725 · GHSA-333X-W4R6-6CRP |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Low
|
Fix reported |
|
| proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetCVE-2026-90711 · GHSA-JQCG-44MW-7W3H |
proxy-addrAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Critical
|
Fix reported |
|
| fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-17495 · GHSA-4P3W-J4W9-5JQW |
momentMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| morgan vulnerable to Log Injection via unescaped double quote in quoted log fieldsCVE-2026-87859 · GHSA-9F6G-J8CH-79G4 |
morganCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84292 · GHSA-QW65-CVWX-89V3 |
fast-uriMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationCVE-2026-75975 · GHSA-F65P-4M7J-42XC |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| qs: Denial of Service via Attacker Controlled isBufferCVE-2026-82417 · GHSA-4MJR-XMP4-GH2G |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionCVE-2026-73566 · GHSA-R292-9MHP-454M |
tarExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
