Security
فارسی
All products

Red Hat Ansible Automation Platform 2/python-galaxy-ng

Red Hat · Package
27 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG lodash-amdlodash-es npmRed Hat Medium Fix reported
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-17495 · GHSA-4P3W-J4W9-5JQW momentMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 npmRed Hat Medium Fix reported
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
Axios: Nested axios option objects can consume polluted prototype valuesCVE-2026-67319 · GHSA-7Q8Q-RJ6J-MHJQ axiosGatekeeper 3/gatekeeper/gatekeeper-rhel9 npmRed Hat Medium Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsCVE-2026-44490 · GHSA-898C-Q2CR-XWHG axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios HTTP/2 Session Cleanup State Corruption VulnerabilityCVE-2026-39865 · GHSA-QJ83-CQ47-W5F8 axiosCryostat 4/axios npmRed Hat Medium Fix reported
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLCVE-2025-27152 · GHSA-JR5F-V2JV-69X6 axiosCryostat 3/io.cryostat-cryostat3 npmRed Hat High Fix reported
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 @remix-run/routerreact-router npmRed Hat Medium Fix reported
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningCVE-2026-67320 · GHSA-GCFJ-64VW-6MP9 axiosMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 npmRed Hat High Fix reported
Axios: Prototype pollution gadgets can alter axios request constructionCVE-2026-67316 · GHSA-MMX7-HFXF-JPPX axiosCryostat 4/axios npmRed Hat Medium Fix reported
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationCVE-2026-53666 · GHSA-337J-9HXR-RHXG react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
React Router vulnerable to DoS via unbounded path expansion in __manifest endpointCVE-2026-42342 · GHSA-8X6R-G9MW-2R78 @remix-run/server-runtimereact-router npmRed Hat High Fix reported
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCECVE-2026-42211 · GHSA-49RJ-9FVP-4H2H react-routerOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-rhel9 npmRed Hat High Fix reported
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsCVE-2026-42040 · GHSA-XHJH-PMCV-23JW axiosCryostat 4/axios npmRed Hat Low Fix reported
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionCVE-2026-46625 · GHSA-QJX8-664M-686J js-cookieOpenShift Lightspeed/openshift-lightspeed/lightspeed-console-plugin-419-rhel9 npmRed Hat High Fix reported
Axios: HTTP adapter streamed responses bypass maxContentLengthCVE-2026-42036 · GHSA-VF2M-468P-8V99 axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixCVE-2026-44489 · GHSA-654M-C8P4-X5FP axiosCryostat 4/axios npmRed Hat Low Fix reported