| knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionCVE-2026-54462 · GHSA-2HW4-C9M4-F2FJVersion ranges need review. |
knative.dev/pkgBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel10 |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea allows attackers to add attachments with forbidden file extensionsCVE-2025-68939 · GHSA-263Q-5CV3-XQ9GVersion ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matchingCVE-2026-25542 · GHSA-RMX9-2PP3-XHCRVersion ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ checkCVE-2026-40923 · GHSA-RX35-6RHX-7858Version ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory ExhaustionCVE-2026-40924 · GHSA-M2CX-GPQF-QF74Version ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRunCVE-2026-33022 · GHSA-CV4X-93XX-WGFJVersion ranges need review. |
github.com/tektoncd/pipelineBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. |
urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181 · GHSA-PQ67-6M6Q-MJ2VVersion ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 does not control redirects in browsers and Node.jsCVE-2025-50182 · GHSA-48P4-8XCF-VXJ5Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File WriteCVE-2025-47273 · GHSA-5RJG-FVGR-3XXFVersion ranges need review. |
setuptoolsConfidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Gitea sometimes mishandles propagation of token scope for access control within one of its own package registriesCVE-2025-68944 · GHSA-F85H-C7M6-CFPMVersion ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resourcesCVE-2025-68941 · GHSA-XFQ3-QJ7J-4565Version ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.CVE-2025-68940 · GHSA-RRCW-5RJV-VJ26Version ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Low
|
Fix reported |
|
| Gitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username existsCVE-2025-69413 · GHSA-PC73-RJ2C-WVF9Version ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-textCVE-2025-68942 · GHSA-898P-HH3P-HF9RVersion ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Gitea mishandles authorization for deletion of releasesCVE-2025-68938 · GHSA-CM54-PFMC-XRWXVersion ranges need review. |
code.gitea.io/giteaOpenShift Pipelines/openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
