Security
فارسی
All products

Red Hat Enterprise Linux 8/cockpit

Red Hat · Package
19 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC lodash-amdlodash-es npmRed Hat High Fix reported
Handlebars: JavaScript Injection via Own Property Check BypassCVE-2026-106445 · GHSA-P8WG-VRV2-V86F handlebarsNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat Critical Fix reported
Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip ComponentsCVE-2025-1647 · GHSA-Q58R-HWC8-RM9J bootstrapRed Hat Ceph Storage 4/ceph npmRed Hat Medium No fix reported
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)CVE-2026-106446 · GHSA-8R5X-FM3F-WHWJ handlebarsNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat Critical Fix reported
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat High Fix reported
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat High Fix reported
brace-expansion: Large numeric range defeats documented `max` DoS protectionCVE-2026-45149 · GHSA-JXXR-4GWJ-5JF2 brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ minimatchCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
uuid: Missing buffer bounds check in v3/v5/v6 when buf is providedCVE-2026-41907 · GHSA-W5HQ-G745-H8PQ uuidConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
cockpit: cockpit-storaged: Tang keyserver address from an untrusted LUKS header clevis token reaches curl's argument vector as an optionCVE-2026-125672 Red Hat Enterprise Linux 10/cockpitRed Hat Enterprise Linux 6/cockpit Red Hat Medium No fix reported
cockpit: Authenticated user can kill any process when enabling pam_env's user_readenv optionCVE-2024-6126 Red Hat Enterprise Linux 7/cockpitRed Hat Enterprise Linux 8/cockpit Red Hat Low No fix reported
uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versionsCVE-2026-41988 Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9Confidential Cluster Operator/confidential-clusters-beta/buildroot-rhel9 Red Hat Low No fix reported
cockpit: Cockpit CMS: Arbitrary file read and code execution via path traversalCVE-2026-58467 Red Hat Enterprise Linux 10/cockpitRed Hat Enterprise Linux 7/cockpit Red Hat High No fix reported
cockpit: Cockpit: Unauthorized modification of login records via integer overflowCVE-2026-91142 Red Hat Enterprise Linux 10/cockpitRed Hat Enterprise Linux 7/cockpit Red Hat Low No fix reported
cockpit: Cockpit: Denial of Service via unbounded connection thread spawningCVE-2026-91149 Red Hat Enterprise Linux 7/cockpitRed Hat Enterprise Linux 8/cockpit Red Hat High No fix reported