| fast-uri vulnerable to path traversal via percent-encoded dot segmentsCVE-2026-6321 · GHSA-Q3J6-QGPJ-74H6 |
fast-uriConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| @tootallnate/once vulnerable to Incorrect Control Flow ScopingCVE-2026-3449 · GHSA-VPQ2-C234-7XJ6 |
@tootallnate/onceConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsCVE-2026-27904 · GHSA-23C5-XMQV-RM74 |
minimatchLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| form-data uses unsafe random function in form-data for choosing boundaryCVE-2025-7783 · GHSA-FJXV-7RQG-78G4 |
form-dataLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLCVE-2025-27152 · GHSA-JR5F-V2JV-69X6 |
axiosCryostat 3/io.cryostat-cryostat3 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| path-to-regexp contains a ReDoSCVE-2024-52798 · GHSA-RHX6-C78J-4Q9W |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074 · GHSA-XPQW-6GX7-V673 |
svgoCryostat 4/io.cryostat-cryostat |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Forge has signature forgery in Ed25519 due to missing S > L checkCVE-2026-33895 · GHSA-Q67F-28XG-22RW |
node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| path-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926 · GHSA-J3Q9-MXJG-W52F |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headerCVE-2026-31808 · GHSA-5V7R-6R5C-R473 |
file-typeCryostat 4/io.cryostat-cryostat |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4923 · GHSA-27V5-C462-WPQ7 |
path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)CVE-2026-33896 · GHSA-2328-F5F3-GJ25 |
node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| flatted vulnerable to unbounded recursion DoS in parse() revive phaseCVE-2026-32141 · GHSA-25H7-PFQ9-P65F |
flattedLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| qs's arrayLimit bypass in comma parsing allows denial of serviceCVE-2026-2391 · GHSA-W7FW-MJWX-W883 |
qsCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ |
minimatchCryostat 4/io.cryostat-cryostat |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorCVE-2025-68458 · GHSA-8FGC-7CC6-RX7X |
webpackCryostat 4/io.cryostat-cryostat |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| @isaacs/brace-expansion has Uncontrolled Resource ConsumptionCVE-2026-25547 · GHSA-7H2J-956F-4VF2 |
@isaacs/brace-expansionCryostat 4/io.cryostat-cryostat |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| ajv has ReDoS when using `$data` optionCVE-2025-69873 · GHSA-2G4F-4PWH-QVX6 |
ajvConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistenceCVE-2025-68157 · GHSA-38R7-794H-5758 |
webpackCryostat 4/io.cryostat-cryostat |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
