| protobufjs has an arbitrary code execution issueCVE-2026-41242 · GHSA-XQ3M-2V4X-88GG |
protobufjsOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-rhel8 |
npmRed Hat |
Critical
|
Fix reported |
|
| undici WebSocket client vulnerable to denial of service via fragment count bypassCVE-2026-12151 · GHSA-VXPW-J846-P89Q |
undiciOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40895 · GHSA-R4Q5-VMMM-2653 |
follow-redirectsMigration Toolkit for Applications 8/mta/mta-ui-rhel8 |
npmRed Hat |
Medium
|
Fix reported |
|
| Electron: openExternal permission requests can be attributed to the wrong originCVE-2026-114121 · GHSA-997Q-GVVC-JWMX |
electronRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
Medium
|
Fix reported |
|
| Electron: Pointer lock permission requests can be attributed to the wrong frameCVE-2026-113798 · GHSA-X562-297C-G43G |
electronRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
Medium
|
Fix reported |
|
| joi messages compilation allows prototype replacement through __proto__ error codesCVE-2026-90771 · GHSA-WR44-6HXH-3JWQ |
joiGatekeeper 3/gatekeeper/gatekeeper-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| compression vulnerable to Denial of Service via memory leak on premature response closeCVE-2026-87776 · GHSA-VC2V-76PW-4V95 |
compressionNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPathCVE-2026-76844 · GHSA-G84C-RXFJ-3J2C |
webpack-dev-middlewareNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Low
|
Fix reported |
|
| node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elementsCVE-2026-85393 · GHSA-86W9-CPQP-85RV |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
No fix reported |
|
| fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-17495 · GHSA-4P3W-J4W9-5JQW |
momentMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0CVE-2026-92000 · GHSA-RCW4-F5RP-G42V |
adm-zipRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to Denial of Service via orphaned RetryHandler response bodyCVE-2026-18149 · GHSA-PMJH-FQ2X-6V4X |
undiciOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to downstream response splitting via retry interceptorCVE-2026-18540 · GHSA-R53P-7PC4-XJ5R |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| undici vulnerable to Denial of Service via unrequested WebSocket subprotocolCVE-2026-19534 · GHSA-RFGV-XXQX-MFG5 |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to Denial of Service via unbounded decompression of compressed responsesCVE-2026-84890 · GHSA-3XPG-4RPP-HHHM |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesCVE-2026-84933 · GHSA-2JFJ-6HJV-FM6J |
undiciOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-pf5-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolCVE-2026-84961 · GHSA-W293-VG96-WGC3 |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsCVE-2026-85152 · GHSA-VP8M-P9JH-Q5PM |
undiciExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
