| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40895 · GHSA-R4Q5-VMMM-2653 |
follow-redirectsMigration Toolkit for Applications 8/mta/mta-ui-rhel8 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC |
lodash-amdlodash-es |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-17495 · GHSA-4P3W-J4W9-5JQW |
momentMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84292 · GHSA-QW65-CVWX-89V3 |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676 · GHSA-4C8G-83QW-93J6 |
fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerCVE-2026-88057 · GHSA-HH8M-FM6V-7CVG |
@angular/compiler@angular/core |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationCVE-2026-75975 · GHSA-F65P-4M7J-42XC |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69152 · GHSA-RGW5-RVV9-X895 |
brace-expansionCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSSCVE-2026-75838 · GHSA-55Q2-FJHQ-7XH7 |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Axios: Prototype pollution auth subfields can inject Basic authCVE-2026-67314 · GHSA-XJ6Q-8X83-JV6G |
axiosMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 |
react-routerCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to host confusion via literal backslash authority delimiterCVE-2026-16221 · GHSA-V2HH-GCRM-F6HX |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| React Router: Unauthenticated Denial of Service via Inefficient Route MatchingCVE-2026-55685 · GHSA-CHX6-HX7R-MCP5 |
react-routerExploit Intelligence/exploit-intelligence-tech-preview/agent-client-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Axios: Nested axios option objects can consume polluted prototype valuesCVE-2026-67319 · GHSA-7Q8Q-RJ6J-MHJQ |
axiosGatekeeper 3/gatekeeper/gatekeeper-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsCVE-2026-13149 · GHSA-3JXR-9VMJ-R5CP |
brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)CVE-2026-65898 · GHSA-CMWH-PVXP-8882 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
