| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieCVE-2026-118777 · GHSA-6WVX-3R32-XMCG |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeCVE-2026-118780 · GHSA-4487-J8R4-4G2F |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Forge: AES-GCM authentication bypass via unvalidated tagLength optionCVE-2026-119186 · GHSA-5CWG-6VW7-RJ6P |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Forge: ASN.1 OID first arc truncation in asn1.oidToDerCVE-2026-118775 · GHSA-4642-5MCJ-2RQW |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)CVE-2026-118781 · GHSA-H6CR-WJV9-3CPP |
node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsCVE-2026-118264 · GHSA-CXF3-9H37-7RR8 |
github.com/labstack/echo/v4github.com/labstack/echo/v5 |
GoRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-109932 · GHSA-9FM3-97PX-RJF6 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorCVE-2026-87029 · GHSA-55WC-3PG8-JFW6 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| compress zstd: Panic on two-block framesCVE-2026-116591 · GHSA-FPMH-FRQ8-7RJ8 |
github.com/klauspost/compress/zstdAWS Load Balancer Operator/albo/aws-load-balancer-controller-rhel8 |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of serviceCVE-2026-110872 · GHSA-4G23-2XM8-66GC |
nodemailerRed Hat Developer Hub 1/rhdh/rhdh-hub-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Nodemailer: RFC 5322 comment inside an angle-bracket address is never strippedCVE-2026-110870 · GHSA-G73G-HQQH-JR95 |
nodemailerRed Hat Developer Hub 1/rhdh/rhdh-hub-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| undici vulnerable to Denial of Service via unbounded memory in the EventSource parserCVE-2026-109924 · GHSA-4QV8-2P9J-2685 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensCVE-2026-109841 · GHSA-F72V-6W45-Q472 |
undiciCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110306 · GHSA-W74X-V6F9-J3XG |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110095 · GHSA-XHQ7-XMQJ-769H |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110180 · GHSA-WJR9-J795-JXCR |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
