Red Hat build of Apache Camel - HawtIO 4/rhbac-4/hawtio-rhel9

Red Hat · Package

10 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249	minimatch Cost Management On Premise/costmanagement/costmanagement-ui-rhel10	npmRed Hat	Medium	Fix reported	2026-11-04
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4	glob Cost Management On Premise/costmanagement/costmanagement-ui-rhel10	npmRed Hat	Medium	Fix reported	2026-10-31
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPathCVE-2026-76844 · GHSA-G84C-RXFJ-3J2C	webpack-dev-middleware Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9	npmRed Hat	High	Fix reported	2026-10-03
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionCVE-2026-73566 · GHSA-R292-9MHP-454M	tar Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9	npmRed Hat	High	Fix reported	2026-09-10
flat: flat: Denial of Service via unbounded numeric array keysCVE-2026-119051	Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 OpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9	Red Hat	Medium	No fix reported	Not recorded
open: open: Arbitrary code execution via crafted URLsCVE-2026-119025	Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 Node HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9	Red Hat	High	No fix reported	Not recorded
hawtio-operator: hawtio-operator: Service-CA signing oracle allows arbitrary-CN certificate issuance to namespace edit usersCVE-2026-78234	Red Hat build of Apache Camel - HawtIO 4/rhbac-4/hawtio-operator-bundle Red Hat build of Apache Camel - HawtIO 4/rhbac-4/hawtio-rhel9	Red Hat	High	No fix reported	Not recorded
hawtio-operator: hawtio-operator: Cluster-wide secrets read/write granted to operator ServiceAccountCVE-2026-77968	Red Hat build of Apache Camel - HawtIO 4/rhbac-4/hawtio-rhel9	Red Hat	High	No fix reported	Not recorded
hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routeHostNameCVE-2026-81303	Red Hat build of Apache Camel - HawtIO 4/rhbac-4/hawtio-operator-bundle Red Hat build of Apache Camel - HawtIO 4/rhbac-4/hawtio-rhel9	Red Hat	Medium	No fix reported	Not recorded
hawtio-operator: hawtio-operator: TLS private key written to operator log at debug levelCVE-2026-81320	Red Hat build of Apache Camel - HawtIO 4/rhbac-4/hawtio-rhel9	Red Hat	Medium	No fix reported	Not recorded