| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59879 · GHSA-V56Q-MH7H-F735 |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 |
react-routerCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClassCVE-2025-13281 · GHSA-R6J8-C6R2-37RRبازه‌ها نیاز به بررسی دارند. |
k8s.io/kubernetesBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-rhel9 |
GoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| containerd affected by a local privilege escalation via wide permissions on CRI directoryCVE-2024-25621 · GHSA-PWHC-RPQ9-4C8Wبازه‌ها نیاز به بررسی دارند. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| form-data uses unsafe random function in form-data for choosing boundaryCVE-2025-7783 · GHSA-FJXV-7RQG-78G4 |
form-dataMigration Toolkit for Virtualization/mtv-candidate/mtv-console-plugin-rhel9 |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| path-to-regexp contains a ReDoSCVE-2024-52798 · GHSA-RHX6-C78J-4Q9W |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 |
@remix-run/routerreact-router |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR HydrationCVE-2026-53666 · GHSA-337J-9HXR-RHXG |
react-routerCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| React Router vulnerable to DoS via unbounded path expansion in __manifest endpointCVE-2026-42342 · GHSA-8X6R-G9MW-2R78 |
@remix-run/server-runtimereact-router |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Immutable is vulnerable to Prototype PollutionCVE-2026-29063 · GHSA-WF6X-7X77-MVGW |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2026-0540 · GHSA-V2WJ-7WPQ-C8VV |
dompurifyCryostat 4/io.cryostat-cryostat |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2025-15599 · GHSA-V8JM-5VWX-CFXM |
dompurifyCryostat 4/io.cryostat-cryostat |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| path-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926 · GHSA-J3Q9-MXJG-W52F |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4923 · GHSA-27V5-C462-WPQ7 |
path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorCVE-2025-68458 · GHSA-8FGC-7CC6-RX7X |
webpackCryostat 4/io.cryostat-cryostat |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistenceCVE-2025-68157 · GHSA-38R7-794H-5758 |
webpackCryostat 4/io.cryostat-cryostat |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionCVE-2026-22036 · GHSA-G9MF-H72J-4RW9 |
undiciCryostat 4/io.cryostat-cryostat |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
