| protobufjs has an arbitrary code execution issueCVE-2026-41242 · GHSA-XQ3M-2V4X-88GG |
protobufjsOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-rhel8 |
npmRed Hat |
Critical
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC |
lodash-amdlodash-es |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to path traversal via percent-encoded dot segmentsCVE-2026-6321 · GHSA-Q3J6-QGPJ-74H6 |
fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
High
|
Fix reported |
|
| Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocketCVE-2026-39363 · GHSA-P9FF-H696-F583 |
viteRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/gateway-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
Medium
|
Fix reported |
|
| Picomatch has a ReDoS vulnerability via extglob quantifiersCVE-2026-33671 · GHSA-C2C7-RCM5-VVQJ |
picomatchCryostat 4/picomatch |
npmRed Hat |
High
|
Fix reported |
|
| BuildKit Git URL subdir component can cause access to restricted filesCVE-2026-33748 · GHSA-4VRQ-3VRQ-G6GGVersion ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Vite: `server.fs.deny` bypassed with queriesCVE-2026-39364 · GHSA-V2WJ-Q39Q-566R |
viteRed Hat Ansible Automation Platform 2/automation-controller |
npmRed Hat |
High
|
Fix reported |
|
| Go JOSE Panics in JWE decryptionCVE-2026-34986 · GHSA-78H2-9FRX-2JM8Version ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
High
|
Fix reported |
|
| Vite Vulnerable to Path Traversal in Optimized Deps `.map` HandlingCVE-2026-39365 · GHSA-4W7W-66W2-5VF9 |
viteRed Hat Advanced Cluster Security 4/rhacs-eng/release-main |
npmRed Hat |
Medium
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objectsCVE-2026-34043 · GHSA-QJ8W-GFJ5-8C6V |
serialize-javascriptCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| Forge has signature forgery in Ed25519 due to missing S > L checkCVE-2026-33895 · GHSA-Q67F-28XG-22RW |
node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| path-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926 · GHSA-J3Q9-MXJG-W52F |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| BuildKit's Malicious frontend can cause file escape outside of storage rootCVE-2026-33747 · GHSA-4C29-8RGM-JVJJVersion ranges need review. |
github.com/moby/buildkitAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputCVE-2026-33891 · GHSA-5M6Q-G25R-MVWX |
node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| yaml is vulnerable to Stack Overflow via deeply nested YAML collectionsCVE-2026-33532 · GHSA-48C2-RRV3-QJMP |
yamlMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4923 · GHSA-27V5-C462-WPQ7 |
path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)CVE-2026-33896 · GHSA-2328-F5F3-GJ25 |
node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
