| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Worktree operations may follow symlinksCVE-2026-71556 · GHSA-HC8V-WWC9-VGXMVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
High
|
Fix reported |
|
| BuildKit has a possible runtime DoS via unbounded group parsingCVE-2026-61712 · GHSA-72X6-4J93-7W86Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| BuildKit: Custom frontend could bypass Seccomp/AppArmorCVE-2026-61711 · GHSA-7236-3392-C5C6Version ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| oras-go has file store write outside workingDir via symlink traversalCVE-2026-50162 · GHSA-8XWF-RJM4-XVHVVersion ranges need review. |
oras.land/oras-go/v2Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directoryCVE-2026-8643 · GHSA-WF93-45JW-7689Version ranges need review. |
pipExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustionCVE-2026-44740 · GHSA-M3XC-H892-GGX6Version ranges need review. |
github.com/go-git/go-billy/v5github.com/go-git/go-billy/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557 · GHSA-QGQ7-7HM3-Q39JVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token LeakageCVE-2026-49478 · GHSA-F5MR-Q85P-6HH6Version ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixCVE-2026-45409 · GHSA-65PC-FJ4G-8RJXVersion ranges need review. |
idnaConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| github.com/moby/buildkit: BuildKit: Denial of Service via duplicate Git source metadata resolutionCVE-2026-121522 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| github.com/moby/buildkit: BuildKit: Privilege escalation via unauthorized extended file attribute modificationCVE-2026-121520 |
DPU kit for NVIDIA/dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10DPU kit for NVIDIA/dpu-kit-for-nvidia/must-gather-rhel10 |
Red Hat |
High
|
No fix reported |
|
| buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerabilityCVE-2026-15789 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| github.com/moby/buildkit: BuildKit: File escape vulnerability allows unauthorized file modificationCVE-2026-75593 |
Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9Compliance Operator/compliance/openshift-compliance-must-gather-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()CVE-2026-75803 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDsCVE-2026-88031 |
Assisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
Red Hat |
High
|
No fix reported |
|
| hex: hex: Denial of Service via unconstrained data decompressionCVE-2026-96618 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
