| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Path traversal in webpack-dev-middlewareCVE-2024-29180 · GHSA-WR3J-PWJ9-HQQ6 |
webpack-dev-middlewareMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.CVE-2026-66010 · GHSA-C2J3-45GR-MQC4 |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59879 · GHSA-V56Q-MH7H-F735 |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSSCVE-2026-75838 · GHSA-55Q2-FJHQ-7XH7 |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 |
react-routerCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMCVE-2026-49459 · GHSA-R47G-FVHR-H676 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)CVE-2026-65898 · GHSA-CMWH-PVXP-8882 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| LinkifyIt#match scan loop has quadratic algorithmic complexityCVE-2026-48801 · GHSA-22P9-WV53-3RQ4 |
linkify-itMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackCVE-2026-41238 · GHSA-V9JR-RG53-9PGP |
dompurifyCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| DOMPurify is vulnerable to mutation-XSS via Re-Contextualization CVE-2026-65914 · GHSA-H8R8-WCCR-V5F2 |
dompurifyMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackCVE-2026-27601 · GHSA-QPX9-HPMF-5GMW |
underscoreLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLCVE-2025-27152 · GHSA-JR5F-V2JV-69X6 |
axiosCryostat 3/io.cryostat-cryostat3 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| path-to-regexp contains a ReDoSCVE-2024-52798 · GHSA-RHX6-C78J-4Q9W |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 |
@remix-run/routerreact-router |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationCVE-2026-53666 · GHSA-337J-9HXR-RHXG |
react-routerCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objectsCVE-2026-65901 · GHSA-X4VX-RJVF-J5P4 |
dompurifyAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
کم
|
اصلاح اعلام نشده |
|
| DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentCVE-2026-49978 · GHSA-RP9W-3FW7-7CWQ |
dompurifyCryostat 4/grafana-infinity-datasource-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
