| Zod can exhaust memory while validating oversized constrained collectionsCVE-2023-54404 · GHSA-MRHX-C7XC-M3W5 |
zodAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSSCVE-2026-75838 · GHSA-55Q2-FJHQ-7XH7 |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)CVE-2026-65898 · GHSA-CMWH-PVXP-8882 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify is vulnerable to mutation-XSS via Re-Contextualization CVE-2026-65914 · GHSA-H8R8-WCCR-V5F2 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| qs array-limit bypass via bracket-key comma parsingCVE-2026-82562 · GHSA-X5FP-WJ9C-MXMX |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksCVE-2026-69198 · GHSA-4XRF-JV44-H6HH |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetCVE-2026-69153 · GHSA-FXQJ-RQCC-2CMP |
postcssCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| Axios: Prototype pollution gadgets can alter axios request constructionCVE-2026-67316 · GHSA-MMX7-HFXF-JPPX |
axiosCryostat 4/axios |
npmRed Hat |
Medium
|
Fix reported |
|
| nanoid: custom generators can loop indefinitely when size is zeroCVE-2026-67213 · GHSA-2V37-7H3G-55P8 |
nanoidMigration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objectsCVE-2026-65901 · GHSA-X4VX-RJVF-J5P4 |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Low
|
No fix reported |
|
| DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modesCVE-2026-65900 · GHSA-GVMJ-G25R-R7WR |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Low
|
Fix reported |
|
| DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`CVE-2026-65902 · GHSA-76MC-F452-CXCM |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify USE_PROFILES prototype pollution allows event handlersCVE-2026-65913 · GHSA-CJ63-JHHR-WCXV |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify ADD_ATTR predicate skips URI validationCVE-2026-65912 · GHSA-CJMM-F4JC-QW8R |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` outputCVE-2026-65899 · GHSA-VXR8-FQ34-VVX9 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| adm-zip extraction follows destination symlinks, allowing arbitrary file overwriteCVE-2026-76845 · GHSA-VWC7-R8MQ-G2X9 |
adm-zipRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/volsync-operator-bundle |
npmRed Hat |
Medium
|
No fix reported |
|
| DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization.CVE-2026-65911 |
Migration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9Multicluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| DOMPurify: DOMPurify: Cross-Site Scripting via unsanitized DOM elements from different realmsCVE-2026-65904 |
Migration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9Multicluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| qs: qs: Query parameter injection via unencoded empty array keysCVE-2026-110910 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9Cost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
Red Hat |
Low
|
No fix reported |
|
