| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115906 · GHSA-8HXF-QR8P-62X4 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Highcharts: `javascript:` URL in credits.href runs script on clickCVE-2026-118251 · GHSA-5793-X2Q3-C3Q7 |
highchartsRed Hat Enterprise Linux 10/rust |
npmRed Hat |
High
|
Fix reported |
|
| Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`CVE-2026-118242 · GHSA-6G3C-P4FG-XV47 |
@highcharts/grid-lite@highcharts/grid-pro |
npmRed Hat |
High
|
Fix reported |
|
| Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printingCVE-2026-118244 · GHSA-65HG-CF3F-5M39 |
highchartsRed Hat Enterprise Linux 10/rust |
npmRed Hat |
High
|
Fix reported |
|
| Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesCVE-2026-118246 · GHSA-35RR-XWFH-X789 |
highchartsRed Hat Enterprise Linux 10/rust |
npmRed Hat |
High
|
Fix reported |
|
| Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`CVE-2026-116797 · GHSA-5GHW-9MGR-JVX2 |
@highcharts/dashboards@highcharts/grid-pro |
npmRed Hat |
High
|
Fix reported |
|
| Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported chartsCVE-2026-116796 · GHSA-MW4F-GJ5X-6XR4 |
highchartsRed Hat Enterprise Linux 10/rust |
npmRed Hat |
High
|
Fix reported |
|
| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| ammonia: mXSS via MathML `annotation-xml` encoding stripCVE-2026-63430 · GHSA-9JH8-V38H-CVHRVersion ranges need review. |
ammoniaAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102342 · GHSA-M6MH-2HW2-555XVersion ranges need review. |
ammoniaAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicCVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
