| go-git missing validation decoding Index v4 files leads to panicCVE-2026-33762 · GHSA-GM2X-2G9H-CCM8Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engineCVE-2026-34984 · GHSA-R2PG-R6H7-CRF3Version ranges need review. |
github.com/external-secrets/external-secretsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| go-git improperly verifies data integrity values for .idx and .pack filesCVE-2026-25934 · GHSA-37CX-329C-33X3Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID MatchingCVE-2026-4539 · GHSA-5239-WWWM-4PMQVersion ranges need review. |
pygmentsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClassCVE-2025-13281 · GHSA-R6J8-C6R2-37RRVersion ranges need review. |
k8s.io/kubernetesBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustionCVE-2026-44740 · GHSA-M3XC-H892-GGX6Version ranges need review. |
github.com/go-git/go-billy/v5github.com/go-git/go-billy/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| Tornado has out-of-bounds memory access via C extensionCVE-2026-49854 · GHSA-CX3H-4QPV-8HC9Version ranges need review. |
tornadoExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixCVE-2026-45409 · GHSA-65PC-FJ4G-8RJXVersion ranges need review. |
idnaConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| go-git: Credential leak via cross-host redirect in smart HTTP transportCVE-2026-41506 · GHSA-3XC5-WRHM-F963Version ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-git: Maliciously crafted idx file can cause asymmetric memory consumptionCVE-2026-34165 · GHSA-JHF3-XXHW-2WPPVersion ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645 · GHSA-GC5V-M9X4-R6X2Version ranges need review. |
requestsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| chi has an open redirect vulnerability in the RedirectSlashes middlewareCVE-2025-69725 · GHSA-MQQF-5WVP-8FH8Version ranges need review. |
github.com/go-chi/chi/v2github.com/go-chi/chi/v3 |
GoRed Hat |
Medium
|
Fix reported |
|
| Tornado vulnerable to Header Injection and XSS via reason argumentCVE-2025-67724 · GHSA-PR2V-JX2C-WG9FVersion ranges need review. |
tornadoExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyMdown Extensions has a ReDOS bug in its Figure Capture extensionCVE-2025-68142 · GHSA-R6H4-MM7H-8PMQVersion ranges need review. |
pymdown-extensionsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Tornado has cookie attribute injection via .RequestHandler.set_cookieCVE-2026-35536 · GHSA-FQWM-6JPJ-5WXC |
tornadoExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)CVE-2026-32947 · GHSA-46G3-37RH-V698 |
step-security/harden-runnerExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
GitHub ActionsRed Hat |
Medium
|
Fix reported |
|
| Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)CVE-2026-32946 · GHSA-G699-3X6G-WM3G |
step-security/harden-runnerExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
GitHub ActionsRed Hat |
Medium
|
Fix reported |
|
| cert-manager-controller DoS via Specially Crafted DNS ResponseCVE-2026-25518 · GHSA-GX3X-VQ4P-MHHVVersion ranges need review. |
github.com/cert-manager/cert-managerCryostat 4/cryostat/cryostat-rhel9-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)CVE-2026-25598 · GHSA-CPMJ-H4F6-R6PQ |
step-security/harden-runnerExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
GitHub ActionsRed Hat |
Medium
|
Fix reported |
|
