| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69152 · GHSA-RGW5-RVV9-X895 |
brace-expansionCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsCVE-2026-13149 · GHSA-3JXR-9VMJ-R5CP |
brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
Medium
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ |
minimatchCryostat 4/io.cryostat-cryostat |
npmRed Hat |
High
|
Fix reported |
|
| @isaacs/brace-expansion has Uncontrolled Resource ConsumptionCVE-2026-25547 · GHSA-7H2J-956F-4VF2 |
@isaacs/brace-expansionCryostat 4/io.cryostat-cryostat |
npmRed Hat |
High
|
Fix reported |
|
| js-yaml: YAML merge-key chains can force quadratic CPU consumptionCVE-2026-59869 · GHSA-52CP-R559-CP3M |
js-yamlCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
High
|
Fix reported |
|
| js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesCVE-2026-84375 · GHSA-2883-XCG3-V3HH |
js-yamlAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| uuid: Missing buffer bounds check in v3/v5/v6 when buf is providedCVE-2026-41907 · GHSA-W5HQ-G745-H8PQ |
uuidConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| eslint: eslint: Denial of Service via stack overflow when serializing objects with circular referencesCVE-2025-50537 |
Cryostat 4/io.cryostat-cryostatLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
Red Hat |
Medium
|
No fix reported |
|
| 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflowCVE-2025-14905 |
Red Hat Directory Server 12/redhat-ds:12/389-ds-baseRed Hat Directory Server 13/389-ds-base |
Red Hat |
Medium
|
No fix reported |
|
| 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in SSO token handlerCVE-2026-11785 |
Red Hat Directory Server 12/redhat-ds:12/389-ds-baseRed Hat Directory Server 13/389-ds-base |
Red Hat |
Medium
|
No fix reported |
|
| 389-ds-base: 389-ds-base: heap out-of-bounds read in LDIF parser str2entry_state_information_from_type()CVE-2026-11786 |
Red Hat Directory Server 11/redhat-ds:11/389-ds-baseRed Hat Directory Server 12/redhat-ds:12/389-ds-base |
Red Hat |
Low
|
No fix reported |
|
