| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| pgx: SQL Injection via placeholder confusion with dollar quoted string literalsCVE-2026-41889 · GHSA-J88V-2CHJ-QFWXVersion ranges need review. |
github.com/jackc/pgx/v4github.com/jackc/pgx/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| form-data uses unsafe random function in form-data for choosing boundaryCVE-2025-7783 · GHSA-FJXV-7RQG-78G4 |
form-dataMigration Toolkit for Virtualization/mtv-candidate/mtv-console-plugin-rhel9 |
npmRed Hat |
Critical
|
Fix reported |
|
| qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionCVE-2025-15284 · GHSA-6RW7-VPXM-498P |
qsLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
npmRed Hat |
Medium
|
Fix reported |
|
| mdast-util-to-hast has unsanitized class attributeCVE-2025-66400 · GHSA-4FH9-H7WG-Q85M |
mdast-util-to-hastGatekeeper 3/gatekeeper/gatekeeper-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| body-parser is vulnerable to denial of service when url encoding is usedCVE-2025-13466 · GHSA-WQCH-XFXH-VRR4 |
body-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| node-forge is vulnerable to ASN.1 OID Integer TruncationCVE-2025-66030 · GHSA-65CH-62R8-G69G |
node-forgeCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| node-forge has ASN.1 Unbounded RecursionCVE-2025-66031 · GHSA-554W-WPV2-VW27 |
node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator DesynchronizationCVE-2025-12816 · GHSA-5GFM-WPXJ-WJGQ |
node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| Axios is vulnerable to DoS attack through lack of data size checkCVE-2025-58754 · GHSA-4HJH-WCWX-XVWJ |
axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| sha.js is missing type checks leading to hash rewind and passing on crafted dataCVE-2025-9288 · GHSA-95M3-7Q98-8XR5 |
sha.jsOpenShift Pipelines/openshift-pipelines/pipelines-hub-db-migration-rhel9 |
npmRed Hat |
Critical
|
Fix reported |
|
| cipher-base is missing type checks, leading to hash rewind and passing on crafted dataCVE-2025-9287 · GHSA-CPQ7-6GPM-G9RC |
cipher-baseLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
Critical
|
Fix reported |
|
| urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181 · GHSA-PQ67-6M6Q-MJ2VVersion ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| pbkdf2 silently disregards Uint8Array input, returning static keysCVE-2025-6547 · GHSA-V62P-RQ8G-8H59 |
pbkdf2Logging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
Critical
|
Fix reported |
|
| webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browserCVE-2025-30360 · GHSA-9JGG-88MC-972H |
webpack-dev-serverCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| on-headers is vulnerable to http response header manipulationCVE-2025-7339 · GHSA-76C9-3JPH-RJ3Q |
on-headersCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| urllib3 does not control redirects in browsers and Node.jsCVE-2025-50182 · GHSA-48P4-8XCF-VXJ5Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| webpack-dev-server users' source code may be stolen when they access a malicious web siteCVE-2025-30359 · GHSA-4V9V-HFQ4-RM2V |
webpack-dev-serverCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File WriteCVE-2025-47273 · GHSA-5RJG-FVGR-3XXFVersion ranges need review. |
setuptoolsConfidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
