| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC |
lodash-amdlodash-es |
npmRed Hat |
High
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59879 · GHSA-V56Q-MH7H-F735 |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMCVE-2026-49459 · GHSA-R47G-FVHR-H676 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| LinkifyIt#match scan loop has quadratic algorithmic complexityCVE-2026-48801 · GHSA-22P9-WV53-3RQ4 |
linkify-itMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackCVE-2026-41238 · GHSA-V9JR-RG53-9PGP |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackCVE-2026-27601 · GHSA-QPX9-HPMF-5GMW |
underscoreLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
Medium
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| form-data uses unsafe random function in form-data for choosing boundaryCVE-2025-7783 · GHSA-FJXV-7RQG-78G4 |
form-dataLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
Critical
|
Fix reported |
|
| React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 |
@remix-run/routerreact-router |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksCVE-2026-49458 · GHSA-HPCV-96WG-7VJ8 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| React Router vulnerable to DoS via unbounded path expansion in __manifest endpointCVE-2026-42342 · GHSA-8X6R-G9MW-2R78 |
@remix-run/server-runtimereact-router |
npmRed Hat |
High
|
Fix reported |
|
| DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)CVE-2026-41240 · GHSA-H7MW-GPVR-XQ4M |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modeCVE-2026-41239 · GHSA-CRV5-9VWW-Q3G8 |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| Immutable is vulnerable to Prototype PollutionCVE-2026-29063 · GHSA-WF6X-7X77-MVGW |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2026-0540 · GHSA-V2WJ-7WPQ-C8VV |
dompurifyCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
