| go-git missing validation decoding Index v4 files leads to panicCVE-2026-33762 · GHSA-GM2X-2G9H-CCM8Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
Medium
|
Fix reported |
|
| Picomatch has a ReDoS vulnerability via extglob quantifiersCVE-2026-33671 · GHSA-C2C7-RCM5-VVQJ |
picomatchCryostat 4/picomatch |
npmRed Hat |
High
|
Fix reported |
|
| go-git improperly verifies data integrity values for .idx and .pack filesCVE-2026-25934 · GHSA-37CX-329C-33X3Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Formidable relies on hexoid to prevent guessing of filenames for untrusted executable contentCVE-2025-46653 · GHSA-75V8-2H7P-7M2M |
formidableOpenShift Serverless/openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 |
npmRed Hat |
Low
|
Fix reported |
|
| jwt-go allows excessive memory allocation during header parsingCVE-2025-30204 · GHSA-MH63-6H87-95CPVersion ranges need review. |
github.com/golang-jwt/jwt/v4github.com/golang-jwt/jwt/v5 |
GoRed Hat |
High
|
Fix reported |
|
| Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/cryptoCVE-2024-45337 · GHSA-V778-237X-GJRCVersion ranges need review. |
golang.org/x/cryptoBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel8 |
GoRed Hat |
Critical
|
Fix reported |
|
| go-git: Credential leak via cross-host redirect in smart HTTP transportCVE-2026-41506 · GHSA-3XC5-WRHM-F963Version ranges need review. |
github.com/go-git/go-git/v5github.com/go-git/go-git/v6 |
GoRed Hat |
Medium
|
Fix reported |
|
| DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2026-0540 · GHSA-V2WJ-7WPQ-C8VV |
dompurifyCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2025-15599 · GHSA-V8JM-5VWX-CFXM |
dompurifyCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| go-git: Maliciously crafted idx file can cause asymmetric memory consumptionCVE-2026-34165 · GHSA-JHF3-XXHW-2WPPVersion ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Medium
|
Fix reported |
|
| node-tar Symlink Path Traversal via Drive-Relative LinkpathCVE-2026-31802 · GHSA-9PPJ-QMQM-Q256 |
tarLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4923 · GHSA-27V5-C462-WPQ7 |
path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob MatchingCVE-2026-33672 · GHSA-3V7F-55P6-F55P |
picomatchCryostat 4/picomatch |
npmRed Hat |
Medium
|
Fix reported |
|
| qs's arrayLimit bypass in comma parsing allows denial of serviceCVE-2026-2391 · GHSA-W7FW-MJWX-W883 |
qsCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ |
minimatchCryostat 4/io.cryostat-cryostat |
npmRed Hat |
High
|
Fix reported |
|
| Elliptic Uses a Cryptographic Primitive with a Risky ImplementationCVE-2025-14505 · GHSA-848J-6MX2-7J84 |
ellipticLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
Low
|
No fix reported |
|
| node-forge is vulnerable to ASN.1 OID Integer TruncationCVE-2025-66030 · GHSA-65CH-62R8-G69G |
node-forgeCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
