Security
فارسی
All products

Red Hat 3scale API Management Platform 2/3scale-amp21/system

Red Hat · Package
90 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG lodash-amdlodash-es npmRed Hat Medium Fix reported
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC lodash-amdlodash-es npmRed Hat High Fix reported
Denial of service in github.com/shamaton/msgpackCVE-2026-32284 · GHSA-H9Q6-HC68-35RPVersion ranges need review. github.com/shamaton/msgpack/v2github.com/shamaton/msgpack/v3 GoRed Hat High Fix reported
Prototype Pollution via parse() in NodeJS flattedCVE-2026-33228 · GHSA-RF6F-7FWH-WJGH flattedRed Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 npmRed Hat High Fix reported
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 dompurifyCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Low Fix reported
node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
showdown metadata title handling allows cross-site scriptingCVE-2026-59711 · GHSA-CR32-G25G-VXJJ showdownMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 npmRed Hat Medium No fix reported
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`CVE-2026-57435 · GHSA-PHWJ-RPRQ-35PP Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 Red HatRubyGems Low Fix reported
Nokogiri: Possible Use-After-Free in XInclude ProcessingCVE-2026-57438 · GHSA-WFPW-MMFH-QQ69 Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 Red HatRubyGems Low Fix reported
Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetimeCVE-2026-57437 · GHSA-P67V-3W7G-WJG7 Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 Red HatRubyGems Low Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`CVE-2026-57235 · GHSA-5PRR-V3J2-97MH Red Hat 3scale API Management Platform 2/3scale-amp2/backend-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 Red HatRubyGems Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
net-imap vulnerable to command Injection via "raw" arguments to multiple commandsCVE-2026-42257 · GHSA-HM49-WCQC-G2XG Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 Red HatRubyGems Medium Fix reported
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsCVE-2026-44490 · GHSA-898C-Q2CR-XWHG axiosCryostat 4/axios npmRed Hat Medium Fix reported
Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scopingCVE-2026-33637 · GHSA-5RV5-XJ5J-3484 Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 Red HatRubyGems Low Fix reported
net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authenticationCVE-2026-42256 · GHSA-87PF-FPWV-P7M7 Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8 Red HatRubyGems Medium Fix reported
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackCVE-2026-41238 · GHSA-V9JR-RG53-9PGP dompurifyCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported