| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40895 · GHSA-R4Q5-VMMM-2653 |
follow-redirectsMigration Toolkit for Applications 8/mta/mta-ui-rhel8 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC |
lodash-amdlodash-es |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-17495 · GHSA-4P3W-J4W9-5JQW |
momentMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84292 · GHSA-QW65-CVWX-89V3 |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676 · GHSA-4C8G-83QW-93J6 |
fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69152 · GHSA-RGW5-RVV9-X895 |
brace-expansionCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSSCVE-2026-75838 · GHSA-55Q2-FJHQ-7XH7 |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Axios: Prototype pollution auth subfields can inject Basic authCVE-2026-67314 · GHSA-XJ6Q-8X83-JV6G |
axiosMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| fast-uri vulnerable to host confusion via literal backslash authority delimiterCVE-2026-16221 · GHSA-V2HH-GCRM-F6HX |
fast-uriOpenShift Lightspeed/openshift-lightspeed/lightspeed-agentic-console-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Axios: Nested axios option objects can consume polluted prototype valuesCVE-2026-67319 · GHSA-7Q8Q-RJ6J-MHJQ |
axiosGatekeeper 3/gatekeeper/gatekeeper-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsCVE-2026-13149 · GHSA-3JXR-9VMJ-R5CP |
brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)CVE-2026-65898 · GHSA-CMWH-PVXP-8882 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C |
axiosCryostat 4/axios |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: Large numeric range defeats documented `max` DoS protectionCVE-2026-45149 · GHSA-JXXR-4GWJ-5JF2 |
brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM |
axiosCryostat 4/axios |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033 · GHSA-PF86-5X62-JRWF |
axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel8 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0CVE-2026-42043 · GHSA-PMWG-CVHR-8VH7 |
axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
