Security
فارسی
All products

Red Hat Enterprise Linux 10/rh-podman-desktop

Red Hat · Package
16 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Electron: openExternal permission requests can be attributed to the wrong originCVE-2026-114121 · GHSA-997Q-GVVC-JWMX electronRed Hat Build of Podman Desktop/rh-podman-desktop.git npmRed Hat Medium Fix reported
Electron: Pointer lock permission requests can be attributed to the wrong frameCVE-2026-113798 · GHSA-X562-297C-G43G electronRed Hat Build of Podman Desktop/rh-podman-desktop.git npmRed Hat Medium Fix reported
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionsCVE-2026-102676 · GHSA-9QH4-3JW8-366W electronRed Hat Build of Podman Desktop/rh-podman-desktop npmRed Hat High Fix reported
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabledCVE-2026-102675 · GHSA-J84W-JFHQ-VHVJ electronRed Hat Build of Podman Desktop/rh-podman-desktop npmRed Hat High Fix reported
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTabCVE-2026-102673 · GHSA-HQ2X-R82H-9WJ4 electronRed Hat Build of Podman Desktop/rh-podman-desktop npmRed Hat High Fix reported
Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictionsCVE-2026-102674 · GHSA-GR2M-V5GQ-V685 electronRed Hat Build of Podman Desktop/rh-podman-desktop npmRed Hat High Fix reported
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesCVE-2026-75931 · GHSA-5JGF-P345-68V8 fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 npmRed Hat High Fix reported
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationCVE-2026-75975 · GHSA-F65P-4M7J-42XC fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat High Fix reported
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingCVE-2026-75899 · GHSA-FPH4-WMHF-6FWF fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 npmRed Hat High Fix reported
fast-uri vulnerable to host confusion via percent-encoded scheme normalizationCVE-2026-76172 · GHSA-JQFF-G426-HQXP fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat High Fix reported
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File DisclosureCVE-2026-73646 · GHSA-R28C-9Q8G-F849 postcssNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat High Fix reported
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesCVE-2026-84375 · GHSA-2883-XCG3-V3HH js-yamlAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 npmRed Hat High Fix reported
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect MockCVE-2026-84373 · GHSA-82FW-GWWQ-J7X9 @vitest/mockervitest npmRed Hat Medium Fix reported
Electron: Named window.open targets not scoped to the opener's browsing contextCVE-2026-34765 · GHSA-F3PV-WV63-48X8 electronRed Hat Build of Podman Desktop - Tech Preview/redhat-user-workloads/openshift-local-ext npmRed Hat Medium Fix reported
Electron: Crash in clipboard.readImage() on malformed clipboard image dataCVE-2026-34781 · GHSA-F37V-82C4-4X64 electronRed Hat Build of Podman Desktop - Tech Preview/redhat-user-workloads/openshift-local-ext npmRed Hat Low Fix reported
podman-desktop: extension system vulnerable to authentication bypassCVE-2026-24835 Red Hat Build of Podman Desktop/rh-podman-desktopRed Hat Enterprise Linux 10/podman-desktop Red Hat Medium No fix reported