| Zod can exhaust memory while validating oversized constrained collectionsCVE-2023-54404 · GHSA-MRHX-C7XC-M3W5 |
zodAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compressCVE-2026-63209 · GHSA-259R-337F-4RFWVersion ranges need review. |
github.com/klauspost/compressFile Integrity Operator/compliance/openshift-file-integrity-operator-bundle |
GoRed Hat |
High
|
Fix reported |
|
| source-map-js allows event-loop denial of service through indexed source-map section offsetsCVE-2026-93749 · GHSA-68FV-2MGG-JV7Q |
source-map-jsNode HealthCheck Operator/redhat-user-workloads/nhc-bundle-0-9 |
npmRed Hat |
High
|
Fix reported |
|
| compression vulnerable to Denial of Service via memory leak on premature response closeCVE-2026-87776 · GHSA-VC2V-76PW-4V95 |
compressionNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elementsCVE-2026-85393 · GHSA-86W9-CPQP-85RV |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
No fix reported |
|
| basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)CVE-2026-102990 · GHSA-C475-QRG2-PJ4R |
basic-ftpRed Hat Enterprise Linux AI (RHEL AI) 3/rust |
npmRed Hat |
High
|
Fix reported |
|
| moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-17495 · GHSA-4P3W-J4W9-5JQW |
momentMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Prevent DoS on deadlocked established channel in golang.org/x/crypto/sshCVE-2026-56855 · GO-2026-6355 |
golang.org/x/cryptoAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. |
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Worktree operations may follow symlinksCVE-2026-71556 · GHSA-HC8V-WWC9-VGXMVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
High
|
Fix reported |
|
| qs: Denial of Service via Attacker Controlled isBufferCVE-2026-82417 · GHSA-4MJR-XMP4-GH2G |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output ContextCVE-2026-55858 · GHSA-XVR9-35CR-46V9 |
org.mariadb.jdbc:mariadb-java-clientOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)CVE-2026-65898 · GHSA-CMWH-PVXP-8882 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify is vulnerable to mutation-XSS via Re-Contextualization CVE-2026-65914 · GHSA-H8R8-WCCR-V5F2 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| qs array-limit bypass via bracket-key comma parsingCVE-2026-82562 · GHSA-X5FP-WJ9C-MXMX |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsCVE-2026-55857 · GHSA-QXVW-FVWX-5CP7 |
org.mariadb.jdbc:mariadb-java-clientOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557 · GHSA-QGQ7-7HM3-Q39JVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| MariaDB has cleartext password disclosure to a MITM on the initial-handshakeCVE-2026-55856 · GHSA-G9JJ-CGMH-9F38 |
org.mariadb.jdbc:mariadb-java-clientOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| nanoid: custom generators can loop indefinitely when size is zeroCVE-2026-67213 · GHSA-2V37-7H3G-55P8 |
nanoidMigration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| nanoid: non-secure generators can loop indefinitely with negative sizeCVE-2026-67214 · GHSA-28WG-GHJ8-5HJV |
nanoidMigration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
