| Requests vulnerable to .netrc credentials leak via malicious URLsCVE-2024-47081 · GHSA-9HJG-9R4M-MVJ7Version ranges need review. |
requestsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackCVE-2026-27601 · GHSA-QPX9-HPMF-5GMW |
underscoreLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
Medium
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Kubernetes GitRepo Volume Inadvertent Local Repository AccessCVE-2025-1767 · GHSA-3WGM-2GW2-VH5MVersion ranges need review. |
k8s.io/kubernetesRed Hat Ansible Automation Platform 2/ansible-automation-platform-25/ee-supported-rhel9 |
GoRed Hat |
Medium
|
No fix reported |
|
| axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLCVE-2025-27152 · GHSA-JR5F-V2JV-69X6 |
axiosCryostat 3/io.cryostat-cryostat3 |
npmRed Hat |
High
|
Fix reported |
|
| path-to-regexp contains a ReDoSCVE-2024-52798 · GHSA-RHX6-C78J-4Q9W |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| gRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186 · GHSA-P77J-4MVH-X3M3Version ranges need review. |
google.golang.org/grpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Critical
|
Fix reported |
|
| Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645 · GHSA-GC5V-M9X4-R6X2Version ranges need review. |
requestsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| node-tar Symlink Path Traversal via Drive-Relative LinkpathCVE-2026-31802 · GHSA-9PPJ-QMQM-Q256 |
tarLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ |
minimatchCryostat 4/io.cryostat-cryostat |
npmRed Hat |
High
|
Fix reported |
|
| Logrus is vulnerable to DoS when using Entry.Writer()CVE-2025-65637 · GHSA-4F99-4Q7P-P3GHVersion ranges need review. |
github.com/sirupsen/logrusConfidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| body-parser is vulnerable to denial of service when url encoding is usedCVE-2025-13466 · GHSA-WQCH-XFXH-VRR4 |
body-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| node-forge is vulnerable to ASN.1 OID Integer TruncationCVE-2025-66030 · GHSA-65CH-62R8-G69G |
node-forgeCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2025-5197 · GHSA-9356-575X-2W9MVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 |
tmpCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Low
|
Fix reported |
|
| urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181 · GHSA-PQ67-6M6Q-MJ2VVersion ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Starlette has possible denial-of-service vector when parsing large files in multipart formsCVE-2025-54121 · GHSA-2C2J-9GV5-CJ73Version ranges need review. |
starletteOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| on-headers is vulnerable to http response header manipulationCVE-2025-7339 · GHSA-76C9-3JPH-RJ3Q |
on-headersCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| urllib3 does not control redirects in browsers and Node.jsCVE-2025-50182 · GHSA-48P4-8XCF-VXJ5Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
