| Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URLCVE-2026-24117 · GHSA-4C4X-JM2X-PF9JVersion ranges need review. |
github.com/sigstore/rekorAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identityCVE-2026-26958 · GHSA-FW7P-63QQ-7HPRVersion ranges need review. |
filippo.io/edwards25519Cryostat 4/cryostat/cryostat-storage-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| chi has an open redirect vulnerability in the RedirectSlashes middlewareCVE-2025-69725 · GHSA-MQQF-5WVP-8FH8Version ranges need review. |
github.com/go-chi/chi/v2github.com/go-chi/chi/v3 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository NamesCVE-2026-24686 · GHSA-JQC5-W2XX-5VQ4Version ranges need review. |
github.com/theupdateframework/go-tuf/v2OpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-tuf improperly validates the configured threshold for delegationsCVE-2026-23992 · GHSA-FPHV-W9FQ-2525Version ranges need review. |
github.com/theupdateframework/go-tuf/v2OpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| sigstore legacy TUF client allows for arbitrary file writes with target cache path traversalCVE-2026-24137 · GHSA-FCV2-XGW5-PQXFVersion ranges need review. |
github.com/sigstore/sigstoreAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty MessageCVE-2026-23831 · GHSA-273P-M2CW-6833Version ranges need review. |
github.com/sigstore/rekorAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| go-tuf affected by client DoS via malformed server responseCVE-2026-23991 · GHSA-846P-JG2W-W324Version ranges need review. |
github.com/theupdateframework/go-tuf/v2OpenShift Pipelines/openshift-pipelines/pipelines-chains-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181 · GHSA-PQ67-6M6Q-MJ2VVersion ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| CIRCL-Fourq: Missing and wrong validation can lead to incorrect resultsCVE-2025-8556 · GHSA-2X5J-VHC8-9CWMVersion ranges need review. |
github.com/cloudflare/circlBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| urllib3 does not control redirects in browsers and Node.jsCVE-2025-50182 · GHSA-48P4-8XCF-VXJ5Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File WriteCVE-2025-47273 · GHSA-5RJG-FVGR-3XXFVersion ranges need review. |
setuptoolsConfidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityCVE-2025-6015 · GHSA-V6R4-35F9-9RPWVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse CVE-2025-6014 · GHSA-QV3P-FMV3-9HWWVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault Community Edition Denial of Service Though Complex JSON PayloadsCVE-2025-6203 · GHSA-8F82-53H8-2P34Version ranges need review. |
github.com/hashicorp/vaultRed Hat Trusted Artifact Signer/rhtas/client-server-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersCVE-2025-6011 · GHSA-MWGR-84FV-3JH9Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| HashiCorp Vault ldap auth method may not have correctly enforced MFACVE-2025-6013 · GHSA-7RX2-769V-HRWFVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Vault Community Edition rekey and recovery key operations can cause denial of serviceCVE-2025-4656 · GHSA-FHC2-8QX8-6VJ7Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| Hashicorp Vault has Incorrect Validation for Non-CA CertificatesCVE-2025-6037 · GHSA-6C5R-4WFC-3MCXVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault has Lockout Feature Authentication BypassCVE-2025-6004 · GHSA-QGJ7-FMQ2-6CC4Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Data Foundation 4/odf4/cephcsi-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
