Security
فارسی
All products

Red Hat OpenShift distributed tracing 3/rhosdt/tempo-jaeger-query-rhel8

Red Hat · Package
38 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG lodash-amdlodash-es npmRed Hat Medium Fix reported
Memory exhaustion in query parameter parsing in net/urlCVE-2025-61726 · GO-2026-4341 stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 GoRed Hat High Fix reported
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsCVE-2026-27904 · GHSA-23C5-XMQV-RM74 minimatchLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle npmRed Hat High Fix reported
js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryCVE-2025-31125 · GHSA-4R4M-QW57-CHR8 viteRed Hat OpenShift distributed tracing 3/rhosdt/tempo-gateway-opa-rhel8 npmRed Hat Medium Fix reported
Vite has an `server.fs.deny` bypass with an invalid `request-target`CVE-2025-32395 · GHSA-356W-63V5-8WF4 viteRed Hat Ansible Automation Platform 2/automation-controller npmRed Hat Medium Fix reported
SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074 · GHSA-XPQW-6GX7-V673 svgoCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
golang.org/x/net/html has a Quadratic Parsing Complexity issueCVE-2025-47911 · GHSA-W4GW-W5JQ-G9JH golang.org/x/net/htmlgolang.org/x/net GoRed Hat Medium Fix reported
Rollup 4 has Arbitrary File Write via Path TraversalCVE-2026-27606 · GHSA-MW96-CPMX-2VGC rollupOpenShift Pipelines/openshift-pipelines/pipelines-hub-api-rhel8 npmRed Hat High Fix reported
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ minimatchCryostat 4/io.cryostat-cryostat npmRed Hat High Fix reported
minimatch has a ReDoS via repeated wildcards with non-matching literal in patternCVE-2026-26996 · GHSA-3PPC-4F35-3M26 minimatchLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 npmRed Hat High Fix reported
body-parser is vulnerable to denial of service when url encoding is usedCVE-2025-13466 · GHSA-WQCH-XFXH-VRR4 body-parserCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
node-forge has ASN.1 Unbounded RecursionCVE-2025-66031 · GHSA-554W-WPV2-VW27 node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle npmRed Hat High Fix reported
Vite middleware may serve files starting with the same name with the public directoryCVE-2025-58751 · GHSA-G4JQ-H2W9-997C viteCryostat 4/io.cryostat-cryostat npmRed Hat Low Fix reported
Vite's `server.fs` settings were not applied to HTML filesCVE-2025-58752 · GHSA-JQFW-VQ24-V9C3 viteRed Hat Ansible Automation Platform 2/automation-controller npmRed Hat Low Fix reported
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browserCVE-2025-30360 · GHSA-9JGG-88MC-972H webpack-dev-serverCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
on-headers is vulnerable to http response header manipulationCVE-2025-7339 · GHSA-76C9-3JPH-RJ3Q on-headersCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Low Fix reported
golang.org/x/net vulnerable to Cross-site ScriptingCVE-2025-22872 · GHSA-VVGC-356P-C3XWVersion ranges need review. golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 GoRed Hat Medium Fix reported
webpack-dev-server users' source code may be stolen when they access a malicious web siteCVE-2025-30359 · GHSA-4V9V-HFQ4-RM2V webpack-dev-serverCryostat 4/io.cryostat-cryostat npmRed Hat Medium Fix reported
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870 · GHSA-QXP5-GWG8-XV66Version ranges need review. golang.org/x/netstdlib GoRed Hat Medium Fix reported