| lodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800 · GHSA-R5FR-RJXR-66JC |
lodash-amdlodash-es |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Elasticsearch: Insertion of Sensitive Information into Log File via reindex APICVE-2025-37727 · GHSA-56R7-H6MW-RCFV |
org.elasticsearch.plugin:reindex-clientLogging Subsystem for Red Hat OpenShift/elasticsearch-core |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client CertificatesCVE-2025-37731 · GHSA-M9GH-789G-Q5PV |
org.elasticsearch.plugin:x-pack-coreorg.elasticsearch.plugin:x-pack-security |
MavenRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackCVE-2026-27601 · GHSA-QPX9-HPMF-5GMW |
underscoreLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationCVE-2026-33939 · GHSA-9CX6-37PM-9JFF |
handlebarsLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsCVE-2026-27904 · GHSA-23C5-XMQV-RM74 |
minimatchLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and OptionsCVE-2026-33941 · GHSA-XJPJ-3MR7-GCPF |
handlebarsLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialCVE-2026-33940 · GHSA-XHPV-HC6G-R9C6 |
handlebarsLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassCVE-2026-33871 · GHSA-W9FJ-CFPG-GRVV |
io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objectsCVE-2026-34043 · GHSA-QJ8W-GFJ5-8C6V |
serialize-javascriptCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCECVE-2026-28292 · GHSA-R275-FR43-PM7Q |
simple-gitLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| Forge has signature forgery in Ed25519 due to missing S > L checkCVE-2026-33895 · GHSA-Q67F-28XG-22RW |
node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Netty: HTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-33870 · GHSA-PWQR-WMGM-9RR8 |
io.netty:netty-codec-httpLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
MavenRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| path-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926 · GHSA-J3Q9-MXJG-W52F |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| node-tar Symlink Path Traversal via Drive-Relative LinkpathCVE-2026-31802 · GHSA-9PPJ-QMQM-Q256 |
tarLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputCVE-2026-33891 · GHSA-5M6Q-G25R-MVWX |
node-forgeLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| socket.io allows an unbounded number of binary attachmentsCVE-2026-33151 · GHSA-677M-J7P3-52F9 |
socket.io-parserLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-headerCVE-2026-31808 · GHSA-5V7R-6R5C-R473 |
file-typeCryostat 4/io.cryostat-cryostat |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsCVE-2026-4923 · GHSA-27V5-C462-WPQ7 |
path-to-regexpCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
