| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40895 · GHSA-R4Q5-VMMM-2653 |
follow-redirectsMigration Toolkit for Applications 8/mta/mta-ui-rhel8 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| deepmerge mergeObject() allows prototype poisoning of returned objectsCVE-2026-93753 · GHSA-GCQX-W48M-W2H4 |
deepmergeCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
کم
|
اصلاح اعلام نشده |
|
| lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC |
lodash-amdlodash-es |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84292 · GHSA-QW65-CVWX-89V3 |
fast-uriMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to host confusion via an unclosed bracket in the URI authorityCVE-2026-84394 · GHSA-58MR-GQGX-XQ4G |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37بازه‌ها نیاز به بررسی دارند. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59879 · GHSA-V56Q-MH7H-F735 |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676 · GHSA-4C8G-83QW-93J6 |
fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)CVE-2026-73088 · GHSA-73WF-GQ98-2V4G |
browserslistNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| qs: Denial of Service via Attacker Controlled isBufferCVE-2026-82417 · GHSA-4MJR-XMP4-GH2G |
qsAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69152 · GHSA-RGW5-RVV9-X895 |
brace-expansionCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypassCVE-2026-69192 · GHSA-MWP4-54F8-5FHR |
ip-addressExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
