| knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionCVE-2026-54462 · GHSA-2HW4-C9M4-F2FJVersion ranges need review. |
knative.dev/pkgBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel10 |
GoRed Hat |
Medium
|
Fix reported |
|
| Distrust compromised intermediate certificates in crypto/x509CVE-2026-111943 · GO-2026-6809 |
rustls-webpkiwebpki-root-certs |
Rust / CargoGoRed Hat |
High
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| sigstore-go has a multi-log threshold bypass via single compromised logCVE-2026-49834 · GHSA-9VCR-P3RJ-Q5Q6Version ranges need review. |
github.com/sigstore/sigstore-goOpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matchingCVE-2026-25542 · GHSA-RMX9-2PP3-XHCRVersion ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ checkCVE-2026-40923 · GHSA-RX35-6RHX-7858Version ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URLCVE-2026-24117 · GHSA-4C4X-JM2X-PF9JVersion ranges need review. |
github.com/sigstore/rekorAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Fulcio allocates excessive memory during token parsingCVE-2025-66506 · GHSA-F83F-XPX7-FFPWVersion ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token LeakageCVE-2026-49478 · GHSA-F5MR-Q85P-6HH6Version ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory ExhaustionCVE-2026-40924 · GHSA-M2CX-GPQF-QF74Version ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRunCVE-2026-33022 · GHSA-CV4X-93XX-WGFJVersion ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identityCVE-2026-26958 · GHSA-FW7P-63QQ-7HPRVersion ranges need review. |
filippo.io/edwards25519Cryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| chi has an open redirect vulnerability in the RedirectSlashes middlewareCVE-2025-69725 · GHSA-MQQF-5WVP-8FH8Version ranges need review. |
github.com/go-chi/chi/v2github.com/go-chi/chi/v3 |
GoRed Hat |
Medium
|
Fix reported |
|
| sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalCVE-2026-24137 · GHSA-FCV2-XGW5-PQXFVersion ranges need review. |
github.com/sigstore/sigstoreAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty MessageCVE-2026-23831 · GHSA-273P-M2CW-6833Version ranges need review. |
github.com/sigstore/rekorAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. |
urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
