Security
فارسی
All products

Red Hat Build of Podman Desktop - Tech Preview/rhdesktop/rh-podman-desktop-ext-openshift-local-rhel10

Red Hat · Package
41 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40895 · GHSA-R4Q5-VMMM-2653 follow-redirectsMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat Medium Fix reported
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdapterCVE-2026-44487 · GHSA-P92Q-9VQR-4J8V axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)CVE-2026-44492 · GHSA-PJWM-PJ3P-43MV axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033 · GHSA-PF86-5X62-JRWF axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat High Fix reported
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0CVE-2026-42043 · GHSA-PMWG-CVHR-8VH7 axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495 · GHSA-3G43-6GMG-66JW axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`CVE-2026-44494 · GHSA-35JP-WW65-95WH axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsCVE-2026-44490 · GHSA-898C-Q2CR-XWHG axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Header Injection via Prototype PollutionCVE-2026-42035 · GHSA-6CHQ-WFR3-2HJ9 axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat High Fix reported
PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputCVE-2026-41305 · GHSA-QX2V-QP2M-JG93 postcssCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionCVE-2026-44486 · GHSA-J5F8-GRM9-P9FC axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
form-data: CRLF injection in form-data via unescaped multipart field names and filenamesCVE-2026-12143 · GHSA-HMW2-7CC7-3QXX form-dataNetwork Observability Operator/network-observability/network-observability-console-plugin-pf4-rhel9 npmRed Hat High Fix reported
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionCVE-2026-44496 · GHSA-HFXV-24RG-XRQF axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
Allocation of Resources Without Limits or Throttling in AxiosCVE-2026-44488 · GHSA-777C-7FJR-54VF axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsCVE-2026-42040 · GHSA-XHJH-PMCV-23JW axiosCryostat 4/axios npmRed Hat Low Fix reported
postcss-selector-parser allows denial of service through uncontrolled AST recursionCVE-2026-9358 · GHSA-W9M9-85WC-3X92 postcss-selector-parserCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Low Fix reported
Axios: HTTP adapter streamed responses bypass maxContentLengthCVE-2026-42036 · GHSA-VF2M-468P-8V99 axiosCryostat 4/axios npmRed Hat Medium Fix reported
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyCVE-2026-42041 · GHSA-W9J2-PVGH-6H63 axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 npmRed Hat Medium Fix reported