| Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configurationCVE-2025-59471 · GHSA-9G9P-9GW9-JX7F |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| form-data uses unsafe random function in form-data for choosing boundaryCVE-2025-7783 · GHSA-FJXV-7RQG-78G4 |
form-dataMigration Toolkit for Virtualization/mtv-candidate/mtv-console-plugin-rhel9 |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLCVE-2025-27152 · GHSA-JR5F-V2JV-69X6 |
axiosCryostat 3/io.cryostat-cryostat3 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2026-0540 · GHSA-V2WJ-7WPQ-C8VV |
dompurifyCryostat 4/io.cryostat-cryostat |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| DOMPurify contains a Cross-site Scripting vulnerabilityCVE-2025-15599 · GHSA-V8JM-5VWX-CFXM |
dompurifyCryostat 4/io.cryostat-cryostat |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Next.js: HTTP request smuggling in rewritesCVE-2026-29057 · GHSA-GGV3-7P47-PFV8 |
nextRed Hat Enterprise Linux 9/dotnet7.0 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| flatted vulnerable to unbounded recursion DoS in parse() revive phaseCVE-2026-32141 · GHSA-25H7-PFQ9-P65F |
flattedLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| qs's arrayLimit bypass in comma parsing allows denial of serviceCVE-2026-2391 · GHSA-W7FW-MJWX-W883 |
qsCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsCVE-2026-27903 · GHSA-7R86-CG39-JMMJ |
minimatchCryostat 4/io.cryostat-cryostat |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behaviorCVE-2025-68458 · GHSA-8FGC-7CC6-RX7X |
webpackCryostat 4/io.cryostat-cryostat |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| @isaacs/brace-expansion has Uncontrolled Resource ConsumptionCVE-2026-25547 · GHSA-7H2J-956F-4VF2 |
@isaacs/brace-expansionCryostat 4/io.cryostat-cryostat |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| bn.js affected by an infinite loopCVE-2026-2739 · GHSA-378V-28HJ-76WF |
bn.jsLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistenceCVE-2025-68157 · GHSA-38R7-794H-5758 |
webpackCryostat 4/io.cryostat-cryostat |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Next.js has Unbounded Memory Consumption via PPR Resume Endpoint CVE-2025-59472 · GHSA-5F7Q-JPQC-WP7H |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Elliptic Uses a Cryptographic Primitive with a Risky ImplementationCVE-2025-14505 · GHSA-848J-6MX2-7J84 |
ellipticLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
کم
|
اصلاح اعلام نشده |
|
| Playwright downloads and installs browsers without verifying the authenticity of the SSL certificateCVE-2025-59288 · GHSA-7MVR-C777-76HP |
playwrightMigration Toolkit for Virtualization/mtv-candidate/mtv-console-plugin-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Axios is vulnerable to DoS attack through lack of data size checkCVE-2025-58754 · GHSA-4HJH-WCWX-XVWJ |
axiosMigration Toolkit for Applications 8/mta/mta-ui-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Next.js Content Injection Vulnerability for Image OptimizationCVE-2025-55173 · GHSA-XV57-4MR9-WG8V |
nextRed Hat Enterprise Linux 10/firefox |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| sha.js is missing type checks leading to hash rewind and passing on crafted dataCVE-2025-9288 · GHSA-95M3-7Q98-8XR5 |
sha.jsOpenShift Pipelines/openshift-pipelines/pipelines-hub-db-migration-rhel9 |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
