| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Sensitive headers not cleared on cross-origin redirect in net/httpCVE-2025-4673 · GO-2025-3751 |
stdlibCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip ComponentsCVE-2025-1647 · GHSA-Q58R-HWC8-RM9J |
bootstrapRed Hat Ceph Storage 4/ceph |
npmRed Hat |
Medium
|
No fix reported |
|
| @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and nameCVE-2026-74866 · GHSA-GXM5-99CW-XJW9 |
@fastify/busboyRed Hat AMQ Broker 7/amq-broker-bin.zip |
npmRed Hat |
Medium
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part headerCVE-2026-19481 · GHSA-X8MW-P69M-V3MX |
@fastify/busboyOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-68494 · GHSA-R7WM-3CXJ-WFF9 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
High
|
Fix reported |
|
| Unexpected session resumption in crypto/tlsCVE-2025-68121 · GO-2026-4337 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| qs: Denial of Service via Attacker Controlled isBufferCVE-2026-82417 · GHSA-4MJR-XMP4-GH2G |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSSCVE-2026-75838 · GHSA-55Q2-FJHQ-7XH7 |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteCVE-2026-59903 · GHSA-8C42-7QJ2-3J46 |
io.netty:netty-codec-httpExploit Intelligence/exploit-intelligence/agent-client-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)CVE-2026-65898 · GHSA-CMWH-PVXP-8882 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify is vulnerable to mutation-XSS via Re-Contextualization CVE-2026-65914 · GHSA-H8R8-WCCR-V5F2 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| qs array-limit bypass via bracket-key comma parsingCVE-2026-82562 · GHSA-X5FP-WJ9C-MXMX |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objectsCVE-2026-65901 · GHSA-X4VX-RJVF-J5P4 |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Low
|
No fix reported |
|
| DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`CVE-2026-65902 · GHSA-76MC-F452-CXCM |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
