| Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client CertificatesCVE-2025-37731 · GHSA-M9GH-789G-Q5PV |
org.elasticsearch.plugin:x-pack-coreorg.elasticsearch.plugin:x-pack-security |
MavenRed Hat |
Medium
|
Fix reported |
|
| ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReaderCVE-2026-10722 · GHSA-XHGW-QWWF-PG32Version ranges need review. |
github.com/cilium/ebpfConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Rack has a Possible Information Disclosure VulnerabilityCVE-2025-61780 · GHSA-R657-RXJC-J557 |
OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8OpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8 |
Red HatRubyGems |
Medium
|
Fix reported |
|
| Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parametersCVE-2025-59830 · GHSA-625H-95R8-8XPM |
OpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8OpenShift Service Mesh 2/openshift-service-mesh/istio-cni-rhel8 |
Red HatRubyGems |
High
|
Fix reported |
|
| Docker: Race condition in docker cp allows bind mount redirection to host pathCVE-2026-42306 · GHSA-RG2X-37C3-W2RHVersion ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
High
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockCVE-2026-22701 · GHSA-QMGC-5H2G-MVRWVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP Vulnerable to Cookie Parser Warning StormCVE-2025-69230 · GHSA-FH55-R93G-J68GVersion ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP vulnerable to DoS through chunked messagesCVE-2025-69229 · GHSA-G84X-MCQJ-X9QQVersion ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP vulnerable to DoS when bypassing assertsCVE-2025-69227 · GHSA-JJ3X-WXRX-4X23Version ranges need review. |
aiohttpOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP has unicode match groups in regexes for ASCII protocol elementsCVE-2025-69225 · GHSA-MQQC-3GQH-H2X8Version ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| pytest has vulnerable tmpdir handlingCVE-2025-71176 · GHSA-6W46-J5RX-G56GVersion ranges need review. |
pytestOpenShift Service Mesh 2/openshift-service-mesh/grafana-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP vulnerable to denial of service through large payloadsCVE-2025-69228 · GHSA-6JHG-HG63-JVVFVersion ranges need review. |
aiohttpOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP vulnerable to brute-force leak of internal static file path componentsCVE-2025-69226 · GHSA-54JQ-C3M8-4M76Version ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| filelock has a TOCTOU race condition which allows symlink attacks during lock file creationCVE-2025-68146 · GHSA-W853-JP5J-5J7FVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| libsodium has Incomplete List of Disallowed InputsCVE-2025-69277 · GHSA-MRFV-M5WM-5W6WVersion ranges need review. |
paragonie/sodium_compathdwallet |
ComposerPyPIRed Hat |
Medium
|
Fix reported |
|
| quic-go HTTP/3 QPACK Header Expansion DoSCVE-2025-64702 · GHSA-G754-HX8W-X2G6Version ranges need review. |
github.com/quic-go/quic-goCryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
