| Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swapCVE-2026-41568 · GHSA-VP62-88P7-QQF5Version ranges need review. |
github.com/docker/dockergithub.com/moby/moby/v2 |
GoRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to path traversal via percent-encoded dot segmentsCVE-2026-6321 · GHSA-Q3J6-QGPJ-74H6 |
fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
High
|
Fix reported |
|
| ws: Uninitialized memory disclosureCVE-2026-45736 · GHSA-58QX-3VCG-4XPX |
wsNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputCVE-2026-41305 · GHSA-QX2V-QP2M-JG93 |
postcssCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| BuildKit Git URL subdir component can cause access to restricted filesCVE-2026-33748 · GHSA-4VRQ-3VRQ-G6GGVersion ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| shell-quote quote() does not escape newlines in object .op valuesCVE-2026-9277 · GHSA-W7JW-789Q-3M8P |
shell-quoteOpenShift Lightspeed/openshift-lightspeed/lightspeed-console-plugin-419-rhel9 |
npmRed Hat |
Critical
|
Fix reported |
|
| ws: Memory exhaustion DoS from tiny fragments and data chunksCVE-2026-48779 · GHSA-96HV-2XVQ-FX4P |
wsNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| postcss-selector-parser allows denial of service through uncontrolled AST recursionCVE-2026-9358 · GHSA-W9M9-85WC-3X92 |
postcss-selector-parserCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Low
|
Fix reported |
|
| fast-uri vulnerable to host confusion via percent-encoded authority delimitersCVE-2026-6322 · GHSA-V39H-62P7-JPJC |
fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
High
|
Fix reported |
|
| Go JOSE Panics in JWE decryptionCVE-2026-34986 · GHSA-78H2-9FRX-2JM8Version ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
High
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| BuildKit's Malicious frontend can cause file escape outside of storage rootCVE-2026-33747 · GHSA-4C29-8RGM-JVJJVersion ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`CVE-2026-27901 · GHSA-PHWV-C562-GVMH |
svelteRed Hat Build of Podman Desktop - Tech Preview/rhdesktop/rh-podman-desktop-ext-bootc-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| Rollup 4 has Arbitrary File Write via Path TraversalCVE-2026-27606 · GHSA-MW96-CPMX-2VGC |
rollupOpenShift Pipelines/openshift-pipelines/pipelines-hub-api-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| Svelte SSR does not validate dynamic element tag names in `<svelte:element>`CVE-2026-27122 · GHSA-M56Q-VW4C-C2CP |
svelteRed Hat Build of Podman Desktop - Tech Preview/rhdesktop/rh-podman-desktop-ext-bootc-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| Svelte SSR attribute spreading includes inherited properties from prototype chainCVE-2026-27125 · GHSA-CRPF-4HRX-3JRP |
svelteRed Hat Build of Podman Desktop - Tech Preview/rhdesktop/rh-podman-desktop-ext-bootc-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| Svelte affected by cross-site scripting via spread attributes in Svelte SSRCVE-2026-27121 · GHSA-F7GR-6P89-R883 |
svelteRed Hat Build of Podman Desktop - Tech Preview/rhdesktop/rh-podman-desktop-ext-bootc-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalCVE-2026-24137 · GHSA-FCV2-XGW5-PQXFVersion ranges need review. |
github.com/sigstore/sigstoreAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex BypassCVE-2026-22772 · GHSA-59JP-PJ84-45MRVersion ranges need review. |
github.com/sigstore/fulcioAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Svelte SSR vulnerable to cross-site scripting via spread attributesCVE-2026-42599 · GHSA-PR6F-5X2Q-RWFP |
svelteRed Hat Build of Podman Desktop - Tech Preview/rhdesktop/rh-podman-desktop-ext-bootc-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
