| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC |
lodash-amdlodash-es |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Denial of service in github.com/shamaton/msgpackCVE-2026-32284 · GHSA-H9Q6-HC68-35RPبازه‌ها نیاز به بررسی دارند. |
github.com/shamaton/msgpack/v2github.com/shamaton/msgpack/v3 |
GoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client CertificatesCVE-2025-37731 · GHSA-M9GH-789G-Q5PV |
org.elasticsearch.plugin:x-pack-coreorg.elasticsearch.plugin:x-pack-security |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59879 · GHSA-V56Q-MH7H-F735 |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerCVE-2026-34230 · GHSA-V569-HP3G-36WR |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter valuesCVE-2026-26962 · GHSA-RX22-G9MX-QRHV |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack's multipart byte range processing allows denial of service via excessive overlapping rangesCVE-2026-34826 · GHSA-X8CG-FQ8G-MXFX |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack has Content-Length mismatch in Rack::Files error responsesCVE-2026-34831 · GHSA-Q2WW-5357-X388 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-RedirectCVE-2026-34830 · GHSA-QV7J-4883-HWH7 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingCVE-2026-32762 · GHSA-QFGR-CRR9-7R49 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack:: Static header_rules bypass via URL-encoded pathsCVE-2026-34786 · GHSA-Q4QF-9J86-F5MH |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack's multipart parsing without Content-Length header allows unbounded chunked file uploadsCVE-2026-34829 · GHSA-8VQR-QJWX-82MW |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsCVE-2026-27904 · GHSA-23C5-XMQV-RM74 |
minimatchLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Rack::Request accepts invalid Host characters, enabling host allowlist bypassCVE-2026-34835 · GHSA-G2PF-XV49-M2H5 |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parametersCVE-2026-34827 · GHSA-V6X5-CG8R-VV6X |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
زیاد
|
اصلاح گزارش شده |
|
| Rack has a root directory disclosure via unescaped regex interpolation in Rack::DirectoryCVE-2026-34763 · GHSA-7MQQ-6CF9-V2QP |
Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundleLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel9-operator |
Red HatRubyGems |
متوسط
|
اصلاح گزارش شده |
|
| Immutable is vulnerable to Prototype PollutionCVE-2026-29063 · GHSA-WF6X-7X77-MVGW |
immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
