| go-git missing validation decoding Index v4 files leads to panicCVE-2026-33762 · GHSA-GM2X-2G9H-CCM8Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of ServiceCVE-2026-53495 · GHSA-7JXH-36Q5-GCQVVersion ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git improperly verifies data integrity values for .idx and .pack filesCVE-2026-25934 · GHSA-37CX-329C-33X3Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URLCVE-2026-24117 · GHSA-4C4X-JM2X-PF9JVersion ranges need review. |
github.com/sigstore/rekorAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71557 · GHSA-QGQ7-7HM3-Q39JVersion ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Credential leak via cross-host redirect in smart HTTP transportCVE-2026-41506 · GHSA-3XC5-WRHM-F963Version ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Maliciously crafted idx file can cause asymmetric memory consumptionCVE-2026-34165 · GHSA-JHF3-XXHW-2WPPVersion ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalCVE-2026-24137 · GHSA-FCV2-XGW5-PQXFVersion ranges need review. |
github.com/sigstore/sigstoreAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty MessageCVE-2026-23831 · GHSA-273P-M2CW-6833Version ranges need review. |
github.com/sigstore/rekorAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archivesCVE-2025-58058 · GHSA-JC7W-C686-C4V9Version ranges need review. |
github.com/ulikunitz/xzAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex BypassCVE-2026-22772 · GHSA-59JP-PJ84-45MRVersion ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| squirrel: Squirrel: Heap-based buffer overflow allows local denial of serviceCVE-2026-8261 |
Deployment Validation Operator/dvo/deployment-validation-rhel8-operatorMCP Server for Red Hat OpenShift/openshift-mcp-beta/openshift-mcp-server-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| submariner-operator: Release workflow consumes same-org composite action via mutable @devel branch refCVE-2026-66783 |
Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-addon-rhel9Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-operator-bundle |
Red Hat |
High
|
No fix reported |
|
| submariner-operator: Operator ClusterRole grants cluster-wide create/update on all ConfigMapsCVE-2026-66782 |
Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-addon-rhel9Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-operator-bundle |
Red Hat |
High
|
No fix reported |
|
| submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authenticationCVE-2026-66781 |
Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-operator-bundle |
Red Hat |
High
|
No fix reported |
|
| submariner-operator: Broker ServiceAccount Secret (token + CA) logged in full at TRACE verbosityCVE-2026-66780 |
Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-operator-bundle |
Red Hat |
High
|
No fix reported |
|
| submariner: submariner: missing validation of remote Endpoint subnets and ClusterID enables cross-cluster traffic hijackCVE-2026-66785 |
Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-addon-rhel9Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-operator-bundle |
Red Hat |
Medium
|
No fix reported |
|
| submariner: submariner: ipsec.conf stanza injection via remote-supplied CableName and SubnetsCVE-2026-66786 |
Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-addon-rhel9Red Hat Advanced Cluster Management for Kubernetes 2/rhacm2/submariner-operator-bundle |
Red Hat |
Medium
|
No fix reported |
|
