| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Formidable relies on hexoid to prevent guessing of filenames for untrusted executable contentCVE-2025-46653 · GHSA-75V8-2H7P-7M2M |
formidableOpenShift Serverless/openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 |
npmRed Hat |
Low
|
Fix reported |
|
| qs's arrayLimit bypass in comma parsing allows denial of serviceCVE-2026-2391 · GHSA-W7FW-MJWX-W883 |
qsCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| time vulnerable to stack exhaustion Denial of Service attackCVE-2026-25727 · GHSA-R6V5-FH4H-64XCVersion ranges need review. |
timeConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ |
minimatchCryostat 4/io.cryostat-cryostat |
npmRed Hat |
High
|
Fix reported |
|
| webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorCVE-2025-68458 · GHSA-8FGC-7CC6-RX7X |
webpackCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| @isaacs/brace-expansion has Uncontrolled Resource ConsumptionCVE-2026-25547 · GHSA-7H2J-956F-4VF2 |
@isaacs/brace-expansionCryostat 4/io.cryostat-cryostat |
npmRed Hat |
High
|
Fix reported |
|
| bn.js affected by an infinite loopCVE-2026-2739 · GHSA-378V-28HJ-76WF |
bn.jsLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
Medium
|
Fix reported |
|
| webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistenceCVE-2025-68157 · GHSA-38R7-794H-5758 |
webpackCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| Elliptic Uses a Cryptographic Primitive with a Risky ImplementationCVE-2025-14505 · GHSA-848J-6MX2-7J84 |
ellipticLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
Low
|
No fix reported |
|
| Preact has JSON VNode Injection issueCVE-2026-22028 · GHSA-36HM-QXXP-PG3M |
preactLogging Subsystem for Red Hat OpenShift/openshift-logging/fluentd-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| body-parser is vulnerable to denial of service when url encoding is usedCVE-2025-13466 · GHSA-WQCH-XFXH-VRR4 |
body-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| node-tar has a race condition leading to uninitialized memory exposureCVE-2025-64118 · GHSA-29XP-372Q-XQPH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 |
tmpCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| brace-expansion Regular Expression Denial of Service vulnerabilityCVE-2025-5889 · GHSA-V6H2-P8H4-QCJW |
brace-expansionCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML functionCVE-2024-9506 · GHSA-5J4C-8P2G-V4JX |
vueRed Hat Enterprise Linux 10/cldr-emoji-annotation |
npmRed Hat |
Low
|
Fix reported |
|
| Some AES functions may panic when overflow checking is enabled in ringCVE-2025-4432 · GHSA-4P46-PWFR-66X6 |
ringRed Hat Enterprise Linux 10/firefox |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Express Open Redirect vulnerabilityCVE-2024-9266 · GHSA-JJ78-5FMV-MV28 |
expressCryostat 3/express |
npmRed Hat |
Low
|
Fix reported |
|
| node-fetch forwards secure headers to untrusted sitesCVE-2022-0235 · GHSA-R683-J2X4-V87G |
node-fetch.NET Core 3.1 on Red Hat Enterprise Linux/rh-dotnet31-dotnet |
npmRed Hat |
High
|
Fix reported |
|
| polkit: Program run via pkexec as unprivileged user can escape to parent session via TIOCSTI ioctlCVE-2016-2568 |
Red Hat Enterprise Linux 6/polkitRed Hat Enterprise Linux 7/polkit |
Red Hat |
Medium
|
No fix reported |
|
