| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
Medium
|
Fix reported |
|
| zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115906 · GHSA-8HXF-QR8P-62X4 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| next.js cache leak across root param values in nested 'use cache' functionsCVE-2026-103004 · GHSA-H694-7CP9-M8P3 |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityCVE-2026-104150 · GHSA-524C-H47V-M3H8 |
@adonisjs/http-serverNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Multiple issues involving quote API in shlexCVE-2024-58266 · GHSA-R7QV-8R2H-PG27Version ranges need review. |
shlexLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| AdonisJS: Unencoded route parameters can produce open redirectsCVE-2026-107718 · GHSA-2M6Q-8V3H-JQWW |
@adonisjs/http-serverNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pagesCVE-2026-94544 · GHSA-3W37-WQ28-93X7 |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js has cache poisoning of SSG and ISR pages in self-hosted applicationsCVE-2026-94543 · GHSA-4JQV-MC3X-M676 |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js has Server-Side Request Forgery in Image OptimizationCVE-2026-94483 · GHSA-CJQ9-62Q9-8JV4 |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
High
|
Fix reported |
|
| Next.js has information disclosure in development server's Model Context Protocol endpointCVE-2026-94486 · GHSA-39W2-RJM5-CHCV |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Low
|
Fix reported |
|
| Next.js has information disclosure in App Router metadata image routes via dynamicParams bypassCVE-2026-94485 · GHSA-F87G-XV8R-7P7X |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of serviceCVE-2026-94484 · GHSA-MCJ8-R9MP-W47P |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Denial of service in github.com/shamaton/msgpackCVE-2026-32284 · GHSA-H9Q6-HC68-35RPVersion ranges need review. |
github.com/shamaton/msgpack/v2github.com/shamaton/msgpack/v3 |
GoRed Hat |
High
|
Fix reported |
|
| Next.js: Unauthenticated disclosure of internal Server Function endpointsCVE-2026-64643 · GHSA-955P-X3MX-JCVP |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js vulnerable to cross-site scripting in App Router applications using CSP noncesCVE-2026-44581 · GHSA-FFHC-5MCF-PF4Q |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
| Next.js's Middleware / Proxy redirects can be cache-poisonedCVE-2026-44572 · GHSA-3G8H-86W9-WVMQ |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Low
|
Fix reported |
|
| PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputCVE-2026-41305 · GHSA-QX2V-QP2M-JG93 |
postcssCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackCVE-2026-27601 · GHSA-QPX9-HPMF-5GMW |
underscoreLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
High
|
Fix reported |
|
| Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configurationCVE-2025-59471 · GHSA-9G9P-9GW9-JX7F |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
Medium
|
Fix reported |
|
