| Gitea allows attackers to add attachments with forbidden file extensionsCVE-2025-68939 · GHSA-263Q-5CV3-XQ9GVersion ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Distrust compromised intermediate certificates in crypto/x509CVE-2026-111943 · GO-2026-6809 |
rustls-webpkiwebpki-root-certs |
Rust / CargoGoRed Hat |
High
|
Fix reported |
|
| knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionCVE-2026-54462 · GHSA-2HW4-C9M4-F2FJ |
knative.dev/pkgBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel10 |
GoRed Hat |
Medium
|
Fix reported |
|
| Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matchingCVE-2026-25542 · GHSA-RMX9-2PP3-XHCRVersion ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ checkCVE-2026-40923 · GHSA-RX35-6RHX-7858Version ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURLCVE-2026-40161 · GHSA-WJXP-XRPV-XPFFVersion ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-image-bundler-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCECVE-2026-40938 · GHSA-94JR-7PQP-XHCQVersion ranges need review. |
github.com/tektoncd/pipelineOpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory ExhaustionCVE-2026-40924 · GHSA-M2CX-GPQF-QF74Version ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver podCVE-2026-33211 · GHSA-J5Q5-J9GM-2W5CVersion ranges need review. |
github.com/tektoncd/pipelineOpenShift Pipelines/openshift-pipelines/pipelines-cli-tkn-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRunCVE-2026-33022 · GHSA-CV4X-93XX-WGFJVersion ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea: REST API exposes organization membership of private organizations to publicCVE-2026-58417 · GHSA-JR5X-6H83-WRXFVersion ranges need review. |
gitea.devOpenShift Pipelines/openshift-pipelines-client |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea Remember-Me Token Theft Not Invalidating Attacker SessionCVE-2026-56750 · GHSA-RGV6-XP99-6MGJ |
code.gitea.io/giteagitea.dev |
GoRed Hat |
Critical
|
Fix reported |
|
| Gitea: draft release attachment disclosure via missing web authorizationCVE-2026-58432 · GHSA-Q9PG-JJ6X-J9P6 |
code.gitea.io/giteagitea.dev |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea: Repository Visibility Manipulation via Git Push OptionsCVE-2026-58437 · GHSA-8P9H-49RC-QGXJ |
code.gitea.io/giteagitea.dev |
GoRed Hat |
High
|
Fix reported |
|
| Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resourcesCVE-2025-68941 · GHSA-XFQ3-QJ7J-4565Version ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.CVE-2025-68940 · GHSA-RRCW-5RJV-VJ26Version ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Low
|
Fix reported |
|
| Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username existsCVE-2025-69413 · GHSA-PC73-RJ2C-WVF9Version ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea mishandles authorization for deletion of releasesCVE-2025-68938 · GHSA-CM54-PFMC-XRWXVersion ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: Repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline ServiceAccountCVE-2026-50240 |
Builds for Red Hat OpenShift/openshift-builds/openshift-builds-rhel9-operatorOpenShift Pipelines/openshift-pipelines-client |
Red Hat |
High
|
No fix reported |
|
