Security
فارسی
All products

Red Hat build of Apicurio Registry 3/apicurio/apicurio-registry-ui-rhel9

Red Hat · Package
72 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40895 · GHSA-R4Q5-VMMM-2653 follow-redirectsMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat Medium Fix reported
lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC lodash-amdlodash-es npmRed Hat High Fix reported
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 dompurifyCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Low Fix reported
moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-17495 · GHSA-4P3W-J4W9-5JQW momentMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 npmRed Hat Medium Fix reported
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat High Fix reported
fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84292 · GHSA-QW65-CVWX-89V3 fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 npmRed Hat High Fix reported
fast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676 · GHSA-4C8G-83QW-93J6 fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat High Fix reported
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69152 · GHSA-RGW5-RVV9-X895 brace-expansionCryostat 4/grafana-infinity-datasource-npm npmRed Hat High Fix reported
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSSCVE-2026-75838 · GHSA-55Q2-FJHQ-7XH7 dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 npmRed Hat Medium Fix reported
Axios: Prototype pollution auth subfields can inject Basic authCVE-2026-67314 · GHSA-XJ6Q-8X83-JV6G axiosMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 npmRed Hat Medium Fix reported
fast-uri vulnerable to host confusion via literal backslash authority delimiterCVE-2026-16221 · GHSA-V2HH-GCRM-F6HX fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 npmRed Hat High Fix reported
Axios: Nested axios option objects can consume polluted prototype valuesCVE-2026-67319 · GHSA-7Q8Q-RJ6J-MHJQ axiosGatekeeper 3/gatekeeper/gatekeeper-rhel9 npmRed Hat Medium Fix reported
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsCVE-2026-13149 · GHSA-3JXR-9VMJ-R5CP brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat High Fix reported
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)CVE-2026-65898 · GHSA-CMWH-PVXP-8882 dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 npmRed Hat Medium Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
brace-expansion: Large numeric range defeats documented `max` DoS protectionCVE-2026-45149 · GHSA-JXXR-4GWJ-5JF2 brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033 · GHSA-PF86-5X62-JRWF axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat High Fix reported
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0CVE-2026-42043 · GHSA-PMWG-CVHR-8VH7 axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported