Security
فارسی
All products

Red Hat OpenShift AI (RHOAI)/rhoai/odh-dashboard-rhel8

Red Hat · Package
77 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG lodash-amdlodash-es npmRed Hat Medium Fix reported
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
Requests vulnerable to .netrc credentials leak via malicious URLsCVE-2024-47081 · GHSA-9HJG-9R4M-MVJ7Version ranges need review. requestsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 PyPIRed Hat Medium Fix reported
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/SetCVE-2026-59880 · GHSA-XVCM-6775-5M9R immutableRed Hat OpenShift AI (RHOAI)/rhoai/odh-core-bff-rhel9 npmRed Hat High Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsCVE-2026-44490 · GHSA-898C-Q2CR-XWHG axiosCryostat 4/axios npmRed Hat Medium Fix reported
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackCVE-2026-41238 · GHSA-V9JR-RG53-9PGP dompurifyCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
Axios HTTP/2 Session Cleanup State Corruption VulnerabilityCVE-2026-39865 · GHSA-QJ83-CQ47-W5F8 axiosCryostat 4/axios npmRed Hat Medium Fix reported
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackCVE-2026-27601 · GHSA-QPX9-HPMF-5GMW underscoreLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle npmRed Hat High Fix reported
brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V brace-expansionCryostat 4/brace-expansion npmRed Hat Medium Fix reported
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFSCVE-2026-23950 · GHSA-R6Q2-HW4H-H46W tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat High Fix reported
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path SanitizationCVE-2026-23745 · GHSA-8QQ5-RM4J-MR97 tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat High Fix reported
js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
form-data uses unsafe random function in form-data for choosing boundaryCVE-2025-7783 · GHSA-FJXV-7RQG-78G4 form-dataMigration Toolkit for Virtualization/mtv-candidate/mtv-console-plugin-rhel9 npmRed Hat Critical Fix reported
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLCVE-2025-27152 · GHSA-JR5F-V2JV-69X6 axiosCryostat 3/io.cryostat-cryostat3 npmRed Hat High Fix reported
path-to-regexp contains a ReDoSCVE-2024-52798 · GHSA-RHX6-C78J-4Q9W path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 npmRed Hat High Fix reported
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 @remix-run/routerreact-router npmRed Hat Medium Fix reported
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setCVE-2026-8723 · GHSA-Q8MJ-M7CP-5Q26 qsConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Axios: HTTP adapter streamed responses bypass maxContentLengthCVE-2026-42036 · GHSA-VF2M-468P-8V99 axiosCryostat 4/axios npmRed Hat Medium Fix reported