| zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115906 · GHSA-8HXF-QR8P-62X4 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| webpki: Name constraints were accepted for certificates asserting a wildcard nameCVE-2026-93601 · GHSA-XGP8-3HG3-C2MHVersion ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logicCVE-2026-93602 · GHSA-PWJX-QHCG-RVJ4Version ranges need review. |
rustls-webpkiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| RMCP: Custom HTTP headers leak to cross-origin redirect targetsCVE-2026-64684 · GHSA-9G45-5XWM-F3WC |
rmcpRed Hat Enterprise Linux 10/goose |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-serviceCVE-2026-63128 · GHSA-9PJ6-VHGR-3MWH |
rmcpRed Hat Enterprise Linux 10/goose |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata DiscoveryCVE-2026-63127 · GHSA-33F5-2C5Q-WGWJ |
rmcpRed Hat Enterprise Linux 10/goose |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsCVE-2026-45623 · GHSA-6G55-P6WH-862Q |
postcssMigration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)CVE-2026-13311 · GHSA-395F-4HP3-45GV |
shell-quoteCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
High
|
Fix reported |
|
| node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
Medium
|
Fix reported |
|
| PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetCVE-2026-69153 · GHSA-FXQJ-RQCC-2CMP |
postcssCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Medium
|
Fix reported |
|
| postcss-selector-parser allows denial of service through uncontrolled AST recursionCVE-2026-9358 · GHSA-W9M9-85WC-3X92 |
postcss-selector-parserCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
Low
|
Fix reported |
|
| nanoid: Integer Overflow or WraparoundCVE-2026-73086 · GHSA-XWG4-73V4-XW9W |
nanoidMigration Toolkit for Containers/rhmtc/openshift-migration-ui-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`CVE-2026-54673 · GHSA-P2F4-R6V6-J797 |
builder-util-runtimeRed Hat Build of Podman Desktop/rh-podman-desktop.git |
npmRed Hat |
High
|
Fix reported |
|
| bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted fileCVE-2026-42250 |
Confidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-payload-rhel9OpenShift Lightspeed/openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| nix: Nix: Arbitrary file truncation via time-of-check/time-of-use raceCVE-2026-64846 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Compute Attestation/agent-sandbox/agent-sandbox-router |
Red Hat |
Low
|
No fix reported |
|
| openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()CVE-2026-75803 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Red Hat |
Low
|
No fix reported |
|
| hex: hex: Denial of Service via unconstrained data decompressionCVE-2026-96618 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| hex: hex: Terminal output spoofing via unescaped control sequencesCVE-2026-81856 |
Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 |
Red Hat |
Medium
|
No fix reported |
|
| cms: light0011 cms: Information disclosure via weak password hashingCVE-2026-112026 |
Red Hat Enterprise Linux 10/gooseRed Hat Enterprise Linux 10/virt-firmware-rs |
Red Hat |
Low
|
No fix reported |
|
