Security
فارسی
All products

Cryostat 4/io.cryostat-cryostat

Red Hat · Package
31 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
@tootallnate/once vulnerable to Incorrect Control Flow ScopingCVE-2026-3449 · GHSA-VPQ2-C234-7XJ6 @tootallnate/onceConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Low Fix reported
js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2026-0540 · GHSA-V2WJ-7WPQ-C8VV dompurifyCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074 · GHSA-XPQW-6GX7-V673 svgoCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2025-15599 · GHSA-V8JM-5VWX-CFXM dompurifyCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoSCVE-2026-2581 · GHSA-PHC3-FGPG-7M6H undiciCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
Undici has CRLF Injection in undici via `upgrade` optionCVE-2026-1527 · GHSA-4992-7RV2-5PVQ undiciCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headerCVE-2026-31808 · GHSA-5V7R-6R5C-R473 file-typeCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4923 · GHSA-27V5-C462-WPQ7 path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
qs's arrayLimit bypass in comma parsing allows denial of serviceCVE-2026-2391 · GHSA-W7FW-MJWX-W883 qsCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Low Fix reported
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ minimatchCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorCVE-2025-68458 · GHSA-8FGC-7CC6-RX7X webpackCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
@isaacs/brace-expansion has Uncontrolled Resource ConsumptionCVE-2026-25547 · GHSA-7H2J-956F-4VF2 @isaacs/brace-expansionCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistenceCVE-2025-68157 · GHSA-38R7-794H-5758 webpackCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionCVE-2026-22036 · GHSA-G9MF-H72J-4RW9 undiciCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
body-parser is vulnerable to denial of service when url encoding is usedCVE-2025-13466 · GHSA-WQCH-XFXH-VRR4 body-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
node-forge is vulnerable to ASN.1 OID Integer TruncationCVE-2025-66030 · GHSA-65CH-62R8-G69G node-forgeCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
node-tar has a race condition leading to uninitialized memory exposureCVE-2025-64118 · GHSA-29XP-372Q-XQPH tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Vite middleware may serve files starting with the same name with the public directoryCVE-2025-58751 · GHSA-G4JQ-H2W9-997C viteCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 tmpCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported