| protobufjs has an arbitrary code execution issueCVE-2026-41242 · GHSA-XQ3M-2V4X-88GG |
protobufjsOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-rhel8 |
npmRed Hat |
Critical
|
Fix reported |
|
| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| PYSEC-2026-4361CVE-2026-114052 · GHSA-823J-M4CJ-HMJF |
vllmRed Hat AI Inference Server/rhaii/vllm-cpu-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PYSEC-2026-4362CVE-2026-114054 · GHSA-RH6F-3X46-J33Q |
vllmRed Hat AI Inference Server/rhaii/vllm-cpu-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-UpCVE-2026-45109 · GHSA-26HH-7CQF-HHC6 |
nextRed Hat Enterprise Linux AI (RHEL AI) 3/rhelai3/bootc-cuda-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40895 · GHSA-R4Q5-VMMM-2653 |
follow-redirectsMigration Toolkit for Applications 8/mta/mta-ui-rhel8 |
npmRed Hat |
Medium
|
Fix reported |
|
| go-git missing validation decoding Index v4 files leads to panicCVE-2026-33762 · GHSA-GM2X-2G9H-CCM8Version ranges need review. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
Low
|
Fix reported |
|
| pypdf has possible infinite loop when hitting EOF in standard xref table during trailer searchCVE-2026-119203 · GHSA-5849-834G-HVW5 |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pypdf has possible large memory usage when parsing page treeCVE-2026-119204 · GHSA-CGGF-277G-3Q54 |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pypdf has possible infinite loop when cloning dictionariesCVE-2026-119205 · GHSA-MFR5-77XH-9J7H |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13CVE-2026-119190 · GHSA-5X38-2VFF-X55P |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageCVE-2026-119188 · GHSA-8HRF-8G6F-7XWP |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Forge: Regular expression denial of service in PEM decoding (pem.decode)CVE-2026-118779 · GHSA-7WCH-P9PX-956X |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Forge: Denial of service in TLS record processing via call stack exhaustionCVE-2026-119187 · GHSA-HQQ3-7JHF-C5JX |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119195 · GHSA-9M75-VC3G-4X39 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pypdf has possible large memory usage for exceptions in strict modeCVE-2026-119207 · GHSA-4VQV-7265-GM2W |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-119194 · GHSA-FM9C-5RCF-2Q5P |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieCVE-2026-118777 · GHSA-6WVX-3R32-XMCG |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
