| zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCECVE-2026-115905 · GHSA-M665-V7PM-7GRJ |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Critical
|
Fix reported |
|
| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionCVE-2026-115909 · GHSA-Q7V9-X93C-XQV3Version ranges need review. |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeCVE-2026-115907 · GHSA-9HJ8-73FH-9963 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. CVE-2026-115908 · GHSA-HJQX-J4RW-G7XV |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115906 · GHSA-8HXF-QR8P-62X4 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC |
lodash-amdlodash-es |
npmRed Hat |
High
|
Fix reported |
|
| Cross-site Scripting (XSS) in serialize-javascriptCVE-2024-11831 · GHSA-76P7-773F-R4Q5 |
serialize-javascript.NET 6.0 on Red Hat Enterprise Linux/rh-dotnet60-dotnet |
npmRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated serversCVE-2026-18140 · GHSA-8FFR-XGWF-XJ56 |
aws-smithy-jsonRed Hat Trusted Profile Analyzer/rhtpa/rhtpa-trustification-service-rhel9 |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| rustls-webpki: Denial of service via panic on malformed CRL BIT STRINGCVE-2026-93599 · GHSA-82J2-J2CH-GFR8Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: Name constraints for URI names were incorrectly acceptedCVE-2026-93600 · GHSA-965H-392X-2MH5Version ranges need review. |
rustls-webpkiConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicCVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| qs: Denial of Service via Attacker Controlled isBufferCVE-2026-82417 · GHSA-4MJR-XMP4-GH2G |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69152 · GHSA-RGW5-RVV9-X895 |
brace-expansionCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
High
|
Fix reported |
|
