Security
فارسی
All products

Network Observability Operator/network-observability/network-observability-console-plugin-compat-rhel9

Red Hat · Package
31 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59879 · GHSA-V56Q-MH7H-F735 immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 npmRed Hat High Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
@tootallnate/once vulnerable to Incorrect Control Flow ScopingCVE-2026-3449 · GHSA-VPQ2-C234-7XJ6 @tootallnate/onceConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Low Fix reported
brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V brace-expansionCryostat 4/brace-expansion npmRed Hat Medium Fix reported
js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 @remix-run/routerreact-router npmRed Hat Medium Fix reported
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsCVE-2026-42040 · GHSA-XHJH-PMCV-23JW axiosCryostat 4/axios npmRed Hat Low Fix reported
Axios: HTTP adapter streamed responses bypass maxContentLengthCVE-2026-42036 · GHSA-VF2M-468P-8V99 axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: unbounded recursion in toFormData causes DoS via deeply nested request dataCVE-2026-42039 · GHSA-62HF-57XW-28J9 axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat Medium Fix reported
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamCVE-2026-42037 · GHSA-445Q-VR5W-6Q77 axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0CVE-2026-42034 · GHSA-5C9X-8GCM-MPGX axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`CVE-2026-42044 · GHSA-3W6X-2G7M-8V23 axiosGatekeeper 3/gatekeeper/gatekeeper-rhel9 npmRed Hat Medium Fix reported
Immutable is vulnerable to Prototype PollutionCVE-2026-29063 · GHSA-WF6X-7X77-MVGW immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 npmRed Hat High Fix reported
DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2026-0540 · GHSA-V2WJ-7WPQ-C8VV dompurifyCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2025-15599 · GHSA-V8JM-5VWX-CFXM dompurifyCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objectsCVE-2026-34043 · GHSA-QJ8W-GFJ5-8C6V serialize-javascriptCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorCVE-2025-68458 · GHSA-8FGC-7CC6-RX7X webpackCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistenceCVE-2025-68157 · GHSA-38R7-794H-5758 webpackCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported