Security
فارسی
All products

Migration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8

Red Hat · Package
79 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of serviceCVE-2026-118772 · GHSA-4528-X5FX-H6HG @hapi/joijoi npmRed Hat High Fix reported
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
joi messages compilation allows prototype replacement through __proto__ error codesCVE-2026-90771 · GHSA-WR44-6HXH-3JWQ joiGatekeeper 3/gatekeeper/gatekeeper-rhel9 npmRed Hat Medium Fix reported
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat High Fix reported
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat Medium Fix reported
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat High Fix reported
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checksCVE-2026-54272 · GHSA-22JQ-VG5J-6VGG ip-addressMigration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8 npmRed Hat Medium Fix reported
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Axios: Nested axios option objects can consume polluted prototype valuesCVE-2026-67319 · GHSA-7Q8Q-RJ6J-MHJQ axiosGatekeeper 3/gatekeeper/gatekeeper-rhel9 npmRed Hat Medium Fix reported
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsCVE-2026-45623 · GHSA-6G55-P6WH-862Q postcssMigration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8 npmRed Hat High Fix reported
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)CVE-2026-13311 · GHSA-395F-4HP3-45GV shell-quoteCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat High Fix reported
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
brace-expansion: Large numeric range defeats documented `max` DoS protectionCVE-2026-45149 · GHSA-JXXR-4GWJ-5JF2 brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported