Security
فارسی
All products

Red Hat OpenShift Virtualization 4/container-native-virtualization/kubevirt-console-plugin

Red Hat · Package
103 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tagsCVE-2026-126066 · GHSA-474X-HRWR-FGX4 fast-xml-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Low Fix reported
Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG lodash-amdlodash-es npmRed Hat Medium Fix reported
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC lodash-amdlodash-es npmRed Hat High Fix reported
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 dompurifyCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Low Fix reported
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
showdown metadata title handling allows cross-site scriptingCVE-2026-59711 · GHSA-CR32-G25G-VXJJ showdownMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 npmRed Hat Medium No fix reported
Axios: Nested axios option objects can consume polluted prototype valuesCVE-2026-67319 · GHSA-7Q8Q-RJ6J-MHJQ axiosGatekeeper 3/gatekeeper/gatekeeper-rhel9 npmRed Hat Medium Fix reported
showdown allows stored cross-site scripting through table header ID injectionCVE-2026-59710 · GHSA-22G5-R2X5-97CX showdownCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium No fix reported
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMCVE-2026-49459 · GHSA-R47G-FVHR-H676 dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 npmRed Hat Medium Fix reported
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)CVE-2026-65898 · GHSA-CMWH-PVXP-8882 dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 npmRed Hat Medium Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495 · GHSA-3G43-6GMG-66JW axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`CVE-2026-44494 · GHSA-35JP-WW65-95WH axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsCVE-2026-44490 · GHSA-898C-Q2CR-XWHG axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Header Injection via Prototype PollutionCVE-2026-42035 · GHSA-6CHQ-WFR3-2HJ9 axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat High Fix reported
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackCVE-2026-41238 · GHSA-V9JR-RG53-9PGP dompurifyCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
Axios HTTP/2 Session Cleanup State Corruption VulnerabilityCVE-2026-39865 · GHSA-QJ83-CQ47-W5F8 axiosCryostat 4/axios npmRed Hat Medium Fix reported
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped DelimitersCVE-2026-41650 · GHSA-GH4J-GQV2-49F6 fast-xml-parserCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported