Security
فارسی
All products

Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7

Red Hat · Package
153 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG lodash-amdlodash-es npmRed Hat Medium Fix reported
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC lodash-amdlodash-es npmRed Hat High Fix reported
Cross-site Scripting (XSS) in serialize-javascriptCVE-2024-11831 · GHSA-76P7-773F-R4Q5 serialize-javascript.NET 6.0 on Red Hat Enterprise Linux/rh-dotnet60-dotnet npmRed Hat Medium Fix reported
Denial of service in github.com/shamaton/msgpackCVE-2026-32284 · GHSA-H9Q6-HC68-35RPVersion ranges need review. github.com/shamaton/msgpack/v2github.com/shamaton/msgpack/v3 GoRed Hat High Fix reported
Prototype Pollution via parse() in NodeJS flattedCVE-2026-33228 · GHSA-RF6F-7FWH-WJGH flattedRed Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 npmRed Hat High Fix reported
Path traversal in webpack-dev-middlewareCVE-2024-29180 · GHSA-WR3J-PWJ9-HQQ6 webpack-dev-middlewareMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 npmRed Hat High Fix reported
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 dompurifyCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Low Fix reported
node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Ruby json: JSON generator heap buffer overflow when streaming to an IOCVE-2026-54696 · GHSA-X2F5-4PRF-W687 Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 Red HatRubyGems Low Fix reported
showdown metadata title handling allows cross-site scriptingCVE-2026-59711 · GHSA-CR32-G25G-VXJJ showdownMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 npmRed Hat Medium No fix reported
showdown allows stored cross-site scripting through table header ID injectionCVE-2026-59710 · GHSA-22G5-R2X5-97CX showdownCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium No fix reported
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`CVE-2026-57435 · GHSA-PHWJ-RPRQ-35PP Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 Red HatRubyGems Low Fix reported
Nokogiri: Possible Use-After-Free in XInclude ProcessingCVE-2026-57438 · GHSA-WFPW-MMFH-QQ69 Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 Red HatRubyGems Low Fix reported
Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimeCVE-2026-57437 · GHSA-P67V-3W7G-WJG7 Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 Red HatRubyGems Low Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`CVE-2026-57235 · GHSA-5PRR-V3J2-97MH Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 Red HatRubyGems Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
net-imap vulnerable to command Injection via "raw" arguments to multiple commandsCVE-2026-42257 · GHSA-HM49-WCQC-G2XG Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 Red HatRubyGems Medium Fix reported