| knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionCVE-2026-54462 · GHSA-2HW4-C9M4-F2FJVersion ranges need review. |
knative.dev/pkgBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel10 |
GoRed Hat |
Medium
|
Fix reported |
|
| kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentCVE-2026-100349 · GHSA-74VM-87HJ-R66FVersion ranges need review. |
github.com/getkin/kin-openapiRed Hat OpenShift AI (RHOAI)/rhoai/odh-core-bff-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)CVE-2026-100348 · GHSA-MH7X-F8WQ-4JHXVersion ranges need review. |
github.com/getkin/kin-openapiRed Hat OpenShift AI (RHOAI)/rhoai/odh-core-bff-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathCVE-2026-100347 · GHSA-FH4F-47MF-F2GJVersion ranges need review. |
github.com/getkin/kin-openapiRed Hat OpenShift AI (RHOAI)/rhoai/odh-core-bff-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation PathCVE-2026-100352 · GHSA-RJ39-CV6W-8WV7Version ranges need review. |
github.com/getkin/kin-openapiRed Hat OpenShift AI (RHOAI)/rhoai/odh-core-bff-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process CrashCVE-2026-100354 · GHSA-G8CF-RCJF-C8CFVersion ranges need review. |
github.com/getkin/kin-openapiRed Hat OpenShift AI (RHOAI)/rhoai/odh-core-bff-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| protobufjs has an arbitrary code execution issueCVE-2026-41242 · GHSA-XQ3M-2V4X-88GG |
protobufjsOpenShift Pipelines/openshift-pipelines/pipelines-console-plugin-rhel8 |
npmRed Hat |
Critical
|
Fix reported |
|
| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| joi: quadratic-time split in `string().email({ multiple: true })` allows denial of serviceCVE-2026-118772 · GHSA-4528-X5FX-H6HG |
@hapi/joijoi |
npmRed Hat |
High
|
Fix reported |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| Distrust compromised intermediate certificates in crypto/x509CVE-2026-111943 · GO-2026-6809 |
rustls-webpkiwebpki-root-certs |
Rust / CargoGoRed Hat |
High
|
Fix reported |
|
| Go JOSE: Panic during CBC-HMAC processingCVE-2026-116585 · GHSA-4W3G-JFJ2-CW2Q |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| Go JOSE: Panics in JSON parsingCVE-2026-116586 · GHSA-VVM8-GF78-28G4 |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/netCVE-2026-116673 · GHSA-4VJG-VX72-QQ4G |
systeminformationCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| systeminformation has prototype pollution in `networkStats()` via the interface nameCVE-2026-116674 · GHSA-7648-JMWF-VW7J |
systeminformationCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/netCVE-2026-97045 · GO-2026-6866 |
golang.org/x/netRed Hat OpenShift AI (RHOAI)/rhoai/odh-ai-gateway-operator-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/netCVE-2026-78661 · GO-2026-6860 |
golang.org/x/netRed Hat OpenShift AI (RHOAI)/rhoai/odh-ai-gateway-operator-rhel9 |
GoRed Hat |
High
|
Fix reported |
|
| Go JOSE: DoS when parsing JWKs that contain RSA keysCVE-2026-116587 · GHSA-MGCC-CWW5-FP2Q |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
High
|
Fix reported |
|
| undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-109932 · GHSA-9FM3-97PX-RJF6 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
