| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)CVE-2026-102827 · GHSA-858H-WHJF-MVG5 |
simple-gitRed Hat Build of Keycloak/keycloak-operator.redhat-00001.zip |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| deepmerge mergeObject() allows prototype poisoning of returned objectsCVE-2026-93753 · GHSA-GCQX-W48M-W2H4 |
deepmergeCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
کم
|
اصلاح اعلام نشده |
|
| Zod can exhaust memory while validating oversized constrained collectionsCVE-2023-54404 · GHSA-MRHX-C7XC-M3W5 |
zodAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileCVE-2026-112948 · GHSA-P458-7748-MCP3 |
@vitest/browser@vitest/ui |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vitest: Code injection via unauthenticated manual mock registrationCVE-2026-112949 · GHSA-QXG6-89MG-RQV8 |
@vitest/mockerRed Hat AMQ Broker 7/amq-broker-bin.zip |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vite: Cross origin script execution through Vite custom middlewareCVE-2026-112945 · GHSA-9JRQ-W75R-8GCW |
vite-plusvite |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`CVE-2026-112947 · GHSA-VFPM-58RQ-9QCG |
vite-plusvite |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineCVE-2026-112946 · GHSA-RQ7H-C2JC-7F22 |
vite-plusvite |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| simple-git allows command execution through unblocked Git configuration includesCVE-2026-102826 · GHSA-G4WM-2VF7-VFGR |
simple-gitRed Hat Build of Keycloak/keycloak-operator.redhat-00001.zip |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| simple-git unsafe-operation guard does not block trailer command configurationCVE-2026-102828 · GHSA-X6JW-M9V5-85VH |
simple-gitRed Hat Build of Keycloak/keycloak-operator.redhat-00001.zip |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| source-map-js allows event-loop denial of service through indexed source-map section offsetsCVE-2026-93749 · GHSA-68FV-2MGG-JV7Q |
source-map-jsNode HealthCheck Operator/redhat-user-workloads/nhc-bundle-0-9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Prototype Pollution via parse() in NodeJS flattedCVE-2026-33228 · GHSA-RF6F-7FWH-WJGH |
flattedRed Hat 3scale API Management Platform 2/3scale-amp2/system-rhel7 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-68494 · GHSA-R7WM-3CXJ-WFF9 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yamlCVE-2026-101043 · GHSA-VX52-2968-3VC6 |
pnpmRed Hat AMQ Broker 7/amq-broker-maven-repository.zip |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect MockCVE-2026-84373 · GHSA-82FW-GWWQ-J7X9 |
@vitest/mockervitest |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
