Security
فارسی
All products

Red Hat Enterprise Linux 8/cockpit-appstream

Red Hat · Package
16 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG lodash-amdlodash-es npmRed Hat Medium Fix reported
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC lodash-amdlodash-es npmRed Hat High Fix reported
Handlebars: JavaScript Injection via Own Property Check BypassCVE-2026-106445 · GHSA-P8WG-VRV2-V86F handlebarsNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat Critical Fix reported
Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip ComponentsCVE-2025-1647 · GHSA-Q58R-HWC8-RM9J bootstrapRed Hat Ceph Storage 4/ceph npmRed Hat Medium No fix reported
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)CVE-2026-106446 · GHSA-8R5X-FM3F-WHWJ handlebarsNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat Critical Fix reported
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat High Fix reported
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat High Fix reported
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ minimatchCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
uuid: Missing buffer bounds check in v3/v5/v6 when buf is providedCVE-2026-41907 · GHSA-W5HQ-G745-H8PQ uuidConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versionsCVE-2026-41988 Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9Confidential Cluster Operator/confidential-clusters-beta/buildroot-rhel9 Red Hat Low No fix reported
cockpit-machines: cockpit-appstream: VNC console password disclosure through virt-xml command-line argumentsCVE-2026-113496 Red Hat Enterprise Linux 10/cockpit-machinesRed Hat Enterprise Linux 8/cockpit-appstream Red Hat Medium No fix reported
cockpit-machines: cockpit-appstream: RHSM access-token disclosure through image helper command-line argumentsCVE-2026-113495 Red Hat Enterprise Linux 10/cockpit-machinesRed Hat Enterprise Linux 8/cockpit-appstream Red Hat Medium No fix reported