Security
فارسی
All products

Migration Toolkit for Applications 8/mta/mta-ui-rhel8

Red Hat · Package
28 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40895 · GHSA-R4Q5-VMMM-2653 follow-redirectsMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat Medium Fix reported
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033 · GHSA-PF86-5X62-JRWF axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat High Fix reported
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsCVE-2026-44490 · GHSA-898C-Q2CR-XWHG axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Header Injection via Prototype PollutionCVE-2026-42035 · GHSA-6CHQ-WFR3-2HJ9 axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat High Fix reported
Axios HTTP/2 Session Cleanup State Corruption VulnerabilityCVE-2026-39865 · GHSA-QJ83-CQ47-W5F8 axiosCryostat 4/axios npmRed Hat Medium Fix reported
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped DelimitersCVE-2026-41650 · GHSA-GH4J-GQV2-49F6 fast-xml-parserCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 @remix-run/routerreact-router npmRed Hat Medium Fix reported
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setCVE-2026-8723 · GHSA-Q8MJ-M7CP-5Q26 qsConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcementCVE-2026-12590 · GHSA-V422-HMWV-36X6 body-parserConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Low Fix reported
Axios: Prototype pollution gadgets can alter axios request constructionCVE-2026-67316 · GHSA-MMX7-HFXF-JPPX axiosCryostat 4/axios npmRed Hat Medium Fix reported
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationCVE-2026-53666 · GHSA-337J-9HXR-RHXG react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesCVE-2026-53550 · GHSA-H67P-54HQ-RP68 js-yamlCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsCVE-2026-42040 · GHSA-XHJH-PMCV-23JW axiosCryostat 4/axios npmRed Hat Low Fix reported
Axios: HTTP adapter streamed responses bypass maxContentLengthCVE-2026-42036 · GHSA-VF2M-468P-8V99 axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyCVE-2026-42041 · GHSA-W9J2-PVGH-6H63 axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat Medium Fix reported
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixCVE-2026-44489 · GHSA-654M-C8P4-X5FP axiosCryostat 4/axios npmRed Hat Low Fix reported