| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC |
lodash-amdlodash-es |
npmRed Hat |
High
|
Fix reported |
|
| Denial of service in github.com/shamaton/msgpackCVE-2026-32284 · GHSA-H9Q6-HC68-35RPVersion ranges need review. |
github.com/shamaton/msgpack/v2github.com/shamaton/msgpack/v3 |
GoRed Hat |
High
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59879 · GHSA-V56Q-MH7H-F735 |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| cryptography has incomplete DNS name constraint enforcement on peer namesCVE-2026-34073 · GHSA-M959-CC7F-WV43Version ranges need review. |
cryptographyLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID MatchingCVE-2026-4539 · GHSA-5239-WWWM-4PMQVersion ranges need review. |
pygmentsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesCVE-2026-26007 · GHSA-R6PH-V2QM-Q3C2Version ranges need review. |
cryptographyExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Immutable is vulnerable to Prototype PollutionCVE-2026-29063 · GHSA-WF6X-7X77-MVGW |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja ResolverCVE-2026-33154 · GHSA-PXRR-HQ57-Q35PVersion ranges need review. |
dynaconfRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/hub-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645 · GHSA-GC5V-M9X4-R6X2Version ranges need review. |
requestsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pip Path Traversal vulnerabilityCVE-2026-1703 · GHSA-6VGW-5PG2-W6JPVersion ranges need review. |
pipLightspeed Core/lightspeed-core/dataverse-exporter-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfigCVE-2026-25639 · GHSA-43FC-JF86-J433 |
axiosLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| pytest has vulnerable tmpdir handlingCVE-2025-71176 · GHSA-6W46-J5RX-G56GVersion ranges need review. |
pytestOpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. |
urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLibCVE-2025-66034 · GHSA-768J-98CG-P3FVVersion ranges need review. |
fonttoolsRed Hat Ansible Automation Platform 2/ansible-automation-platform-tech-preview/automation-dashboard-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementationCVE-2025-6176 · GHSA-2QFP-Q593-8484Version ranges need review. |
brotliscrapy |
PyPIRed Hat |
High
|
Fix reported |
|
| pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. |
pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django has a Race Condition vulnerabilityCVE-2026-25674 · GHSA-MJGH-79QC-68W3Version ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
