Security
فارسی
All products

Red Hat Process Automation 7/org.uberfire-uberfire-parent

Red Hat · Package
29 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
form-data uses unsafe random function in form-data for choosing boundaryCVE-2025-7783 · GHSA-FJXV-7RQG-78G4 form-dataLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 npmRed Hat Critical Fix reported
path-to-regexp contains a ReDoSCVE-2024-52798 · GHSA-RHX6-C78J-4Q9W path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 npmRed Hat High Fix reported
node-tar Symlink Path Traversal via Drive-Relative LinkpathCVE-2026-31802 · GHSA-9PPJ-QMQM-Q256 tarLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle npmRed Hat High Fix reported
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4923 · GHSA-27V5-C462-WPQ7 path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
qs's arrayLimit bypass in comma parsing allows denial of serviceCVE-2026-2391 · GHSA-W7FW-MJWX-W883 qsCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Low Fix reported
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ minimatchCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorCVE-2025-68458 · GHSA-8FGC-7CC6-RX7X webpackCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
@isaacs/brace-expansion has Uncontrolled Resource ConsumptionCVE-2026-25547 · GHSA-7H2J-956F-4VF2 @isaacs/brace-expansionCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
bn.js affected by an infinite loopCVE-2026-2739 · GHSA-378V-28HJ-76WF bn.jsLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle npmRed Hat Medium Fix reported
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistenceCVE-2025-68157 · GHSA-38R7-794H-5758 webpackCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
Elliptic Uses a Cryptographic Primitive with a Risky ImplementationCVE-2025-14505 · GHSA-848J-6MX2-7J84 ellipticLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle npmRed Hat Low No fix reported
body-parser is vulnerable to denial of service when url encoding is usedCVE-2025-13466 · GHSA-WQCH-XFXH-VRR4 body-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
node-forge is vulnerable to ASN.1 OID Integer TruncationCVE-2025-66030 · GHSA-65CH-62R8-G69G node-forgeCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
node-tar has a race condition leading to uninitialized memory exposureCVE-2025-64118 · GHSA-29XP-372Q-XQPH tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameterCVE-2025-54798 · GHSA-52F5-9888-HMC6 tmpCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browserCVE-2025-30360 · GHSA-9JGG-88MC-972H webpack-dev-serverCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
on-headers is vulnerable to http response header manipulationCVE-2025-7339 · GHSA-76C9-3JPH-RJ3Q on-headersCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Low Fix reported
brace-expansion Regular Expression Denial of Service vulnerabilityCVE-2025-5889 · GHSA-V6H2-P8H4-QCJW brace-expansionCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
webpack-dev-server users' source code may be stolen when they access a malicious web siteCVE-2025-30359 · GHSA-4V9V-HFQ4-RM2V webpack-dev-serverCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported