| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)CVE-2026-102827 · GHSA-858H-WHJF-MVG5 |
simple-gitRed Hat Build of Keycloak/keycloak-operator.redhat-00001.zip |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| deepmerge mergeObject() allows prototype poisoning of returned objectsCVE-2026-93753 · GHSA-GCQX-W48M-W2H4 |
deepmergeCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
کم
|
اصلاح اعلام نشده |
|
| Zod can exhaust memory while validating oversized constrained collectionsCVE-2023-54404 · GHSA-MRHX-C7XC-M3W5 |
zodAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileCVE-2026-112948 · GHSA-P458-7748-MCP3 |
@vitest/browser@vitest/ui |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vitest: Code injection via unauthenticated manual mock registrationCVE-2026-112949 · GHSA-QXG6-89MG-RQV8 |
@vitest/mockerRed Hat AMQ Broker 7/amq-broker-bin.zip |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vite: Cross origin script execution through Vite custom middlewareCVE-2026-112945 · GHSA-9JRQ-W75R-8GCW |
vite-plusvite |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`CVE-2026-112947 · GHSA-VFPM-58RQ-9QCG |
vite-plusvite |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineCVE-2026-112946 · GHSA-RQ7H-C2JC-7F22 |
vite-plusvite |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| simple-git allows command execution through unblocked Git configuration includesCVE-2026-102826 · GHSA-G4WM-2VF7-VFGR |
simple-gitRed Hat Build of Keycloak/keycloak-operator.redhat-00001.zip |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| simple-git unsafe-operation guard does not block trailer command configurationCVE-2026-102828 · GHSA-X6JW-M9V5-85VH |
simple-gitRed Hat Build of Keycloak/keycloak-operator.redhat-00001.zip |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| source-map-js allows event-loop denial of service through indexed source-map section offsetsCVE-2026-93749 · GHSA-68FV-2MGG-JV7Q |
source-map-jsNode HealthCheck Operator/redhat-user-workloads/nhc-bundle-0-9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yamlCVE-2026-101043 · GHSA-VX52-2968-3VC6 |
pnpmRed Hat AMQ Broker 7/amq-broker-maven-repository.zip |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| flat: flat: Denial of Service via unbounded numeric array keysCVE-2026-119051 |
Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9OpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
Red Hat |
متوسط
|
اصلاح اعلام نشده |
|
| i18next: i18next: Denial of Service via unsafe recursive object mergingCVE-2026-63402 |
Cryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9Migration Toolkit for Applications 8/mta/mta-ui-rhel9 |
Red Hat |
متوسط
|
اصلاح اعلام نشده |
|
| uri-js: uri-js: Denial of Service via malformed path segmentsCVE-2026-93690 |
Cost Management On Premise/costmanagement/costmanagement-ui-rhel10Multicluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
Red Hat |
زیاد
|
اصلاح اعلام نشده |
|
