Security
فارسی
All products

Red Hat JBoss Enterprise Application Platform Expansion Pack/org.keycloak-keycloak-parent

Red Hat · Package
33 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip ComponentsCVE-2025-1647 · GHSA-Q58R-HWC8-RM9J bootstrapRed Hat Ceph Storage 4/ceph npmRed Hat Medium No fix reported
js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
Vite has an `server.fs.deny` bypass with an invalid `request-target`CVE-2025-32395 · GHSA-356W-63V5-8WF4 viteRed Hat Ansible Automation Platform 2/automation-controller npmRed Hat Medium Fix reported
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoSCVE-2026-2581 · GHSA-PHC3-FGPG-7M6H undiciCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
node-tar Symlink Path Traversal via Drive-Relative LinkpathCVE-2026-31802 · GHSA-9PPJ-QMQM-Q256 tarLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle npmRed Hat High Fix reported
Undici has CRLF Injection in undici via `upgrade` optionCVE-2026-1527 · GHSA-4992-7RV2-5PVQ undiciCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4923 · GHSA-27V5-C462-WPQ7 path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
Undici has an HTTP Request/Response Smuggling issueCVE-2026-1525 · GHSA-2MJP-6Q6P-2QXM undiciOpenShift Lightspeed/openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 npmRed Hat Medium Fix reported
qs's arrayLimit bypass in comma parsing allows denial of serviceCVE-2026-2391 · GHSA-W7FW-MJWX-W883 qsCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Low Fix reported
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ minimatchCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
@isaacs/brace-expansion has Uncontrolled Resource ConsumptionCVE-2026-25547 · GHSA-7H2J-956F-4VF2 @isaacs/brace-expansionCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
ajv has ReDoS when using `$data` optionCVE-2025-69873 · GHSA-2G4F-4PWH-QVX6 ajvConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
minimatch has a ReDoS via repeated wildcards with non-matching literal in patternCVE-2026-26996 · GHSA-3PPC-4F35-3M26 minimatchLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 npmRed Hat High Fix reported
Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionCVE-2026-22036 · GHSA-G9MF-H72J-4RW9 undiciCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
mdast-util-to-hast has unsanitized class attributeCVE-2025-66400 · GHSA-4FH9-H7WG-Q85M mdast-util-to-hastGatekeeper 3/gatekeeper/gatekeeper-rhel9 npmRed Hat Medium Fix reported
Playwright downloads and installs browsers without verifying the authenticity of the SSL certificateCVE-2025-59288 · GHSA-7MVR-C777-76HP playwrightMigration Toolkit for Virtualization/mtv-candidate/mtv-console-plugin-rhel9 npmRed Hat High Fix reported
Vite middleware may serve files starting with the same name with the public directoryCVE-2025-58751 · GHSA-G4JQ-H2W9-997C viteCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
Vite's `server.fs` settings were not applied to HTML filesCVE-2025-58752 · GHSA-JQFW-VQ24-V9C3 viteRed Hat Ansible Automation Platform 2/automation-controller npmRed Hat Low Fix reported
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 tmpCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
brace-expansion Regular Expression Denial of Service vulnerabilityCVE-2025-5889 · GHSA-V6H2-P8H4-QCJW brace-expansionCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported