| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| next.js cache leak across root param values in nested 'use cache' functionsCVE-2026-103004 · GHSA-H694-7CP9-M8P3 |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityCVE-2026-104150 · GHSA-524C-H47V-M3H8 |
@adonisjs/http-serverNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Multiple issues involving quote API in shlexCVE-2024-58266 · GHSA-R7QV-8R2H-PG27Version ranges need review. |
shlexLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pagesCVE-2026-94544 · GHSA-3W37-WQ28-93X7 |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js has cache poisoning of SSG and ISR pages in self-hosted applicationsCVE-2026-94543 · GHSA-4JQV-MC3X-M676 |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js has Server-Side Request Forgery in Image OptimizationCVE-2026-94483 · GHSA-CJQ9-62Q9-8JV4 |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
High
|
Fix reported |
|
| Next.js has information disclosure in development server's Model Context Protocol endpointCVE-2026-94486 · GHSA-39W2-RJM5-CHCV |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Low
|
Fix reported |
|
| Next.js has information disclosure in App Router metadata image routes via dynamicParams bypassCVE-2026-94485 · GHSA-F87G-XV8R-7P7X |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of serviceCVE-2026-94484 · GHSA-MCJ8-R9MP-W47P |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Denial of service in github.com/shamaton/msgpackCVE-2026-32284 · GHSA-H9Q6-HC68-35RPVersion ranges need review. |
github.com/shamaton/msgpack/v2github.com/shamaton/msgpack/v3 |
GoRed Hat |
High
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicCVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`CVE-2026-88059 · GHSA-P297-FM68-3Q8C |
@angular/commonA-MQ Interconnect 1/qpid-dispatch |
npmRed Hat |
Medium
|
Fix reported |
|
| Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerCVE-2026-88057 · GHSA-HH8M-FM6V-7CVG |
@angular/compiler@angular/core |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js: Unauthenticated disclosure of internal Server Function endpointsCVE-2026-64643 · GHSA-955P-X3MX-JCVP |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js vulnerable to cross-site scripting in App Router applications using CSP noncesCVE-2026-44581 · GHSA-FFHC-5MCF-PF4Q |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js's Middleware / Proxy redirects can be cache-poisonedCVE-2026-44572 · GHSA-3G8H-86W9-WVMQ |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Low
|
Fix reported |
|
| PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputCVE-2026-41305 · GHSA-QX2V-QP2M-JG93 |
postcssCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
