| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Multiple issues involving quote API in shlexCVE-2024-58266 · GHSA-R7QV-8R2H-PG27Version ranges need review. |
shlexLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`CVE-2026-88059 · GHSA-P297-FM68-3Q8C |
@angular/commonA-MQ Interconnect 1/qpid-dispatch |
npmRed Hat |
Medium
|
Fix reported |
|
| Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerCVE-2026-88057 · GHSA-HH8M-FM6V-7CVG |
@angular/compiler@angular/core |
npmRed Hat |
Medium
|
Fix reported |
|
| Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackCVE-2026-27601 · GHSA-QPX9-HPMF-5GMW |
underscoreLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| AngularJS improperly sanitizes SVG elementsCVE-2025-0716 · GHSA-J58C-WW9W-PWP5 |
angularLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
Low
|
No fix reported |
|
| Formidable relies on hexoid to prevent guessing of filenames for untrusted executable contentCVE-2025-46653 · GHSA-75V8-2H7P-7M2M |
formidableOpenShift Serverless/openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 |
npmRed Hat |
Low
|
Fix reported |
|
| qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setCVE-2026-8723 · GHSA-Q8MJ-M7CP-5Q26 |
qsConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| qs's arrayLimit bypass in comma parsing allows denial of serviceCVE-2026-2391 · GHSA-W7FW-MJWX-W883 |
qsCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| time vulnerable to stack exhaustion Denial of Service attackCVE-2026-25727 · GHSA-R6V5-FH4H-64XCVersion ranges need review. |
timeConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML AttributesCVE-2025-66412 · GHSA-V4HV-RGFQ-GP49 |
@angular/compilerLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP ClientCVE-2025-66035 · GHSA-58C5-G7WP-6W37 |
@angular/commonLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| `idna` accepts Punycode labels that do not produce any non-ASCII when decodedCVE-2024-12224 · GHSA-H97M-WW89-6JMQVersion ranges need review. |
idnaOpenShift Serverless/openshift-serverless-1/kn-plugin-func-func-util-rhel8 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| `openssl` `X509VerifyParamRef::set_host` buffer over-readCVE-2023-53159 · GHSA-XCF7-RVMH-G6Q4Version ranges need review. |
opensslLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-ServerCVE-2026-41423 · GHSA-45Q2-GJVG-7973 |
@angular/platform-serverRed Hat AMQ Broker 7/angular |
npmRed Hat |
High
|
Fix reported |
|
| Angular vulnerable to XSS in i18n attribute bindingsCVE-2026-32635 · GHSA-G93W-MFHG-P222 |
@angular/compiler@angular/core |
npmRed Hat |
High
|
Fix reported |
|
| Some AES functions may panic when overflow checking is enabled in ringCVE-2025-4432 · GHSA-4P46-PWFR-66X6 |
ringRed Hat Enterprise Linux 10/firefox |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| rust-openssl: rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`CVE-2025-3416 |
Red Hat Directory Server 11/redhat-ds:11/389-ds-baseRed Hat Directory Server 12/redhat-ds:12/389-ds-base |
Red Hat |
Low
|
No fix reported |
|
