| zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCECVE-2026-115905 · GHSA-M665-V7PM-7GRJ |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionCVE-2026-115909 · GHSA-Q7V9-X93C-XQV3بازه‌ها نیاز به بررسی دارند. |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeCVE-2026-115907 · GHSA-9HJ8-73FH-9963 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. CVE-2026-115908 · GHSA-HJQX-J4RW-G7XV |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115906 · GHSA-8HXF-QR8P-62X4 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Highcharts: `javascript:` URL in credits.href runs script on clickCVE-2026-118251 · GHSA-5793-X2Q3-C3Q7 |
highchartsRed Hat Enterprise Linux 10/rust |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`CVE-2026-118242 · GHSA-6G3C-P4FG-XV47 |
@highcharts/grid-lite@highcharts/grid-pro |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printingCVE-2026-118244 · GHSA-65HG-CF3F-5M39 |
highchartsRed Hat Enterprise Linux 10/rust |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesCVE-2026-118246 · GHSA-35RR-XWFH-X789 |
highchartsRed Hat Enterprise Linux 10/rust |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`CVE-2026-116797 · GHSA-5GHW-9MGR-JVX2 |
@highcharts/dashboards@highcharts/grid-pro |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported chartsCVE-2026-116796 · GHSA-MW4F-GJ5X-6XR4 |
highchartsRed Hat Enterprise Linux 10/rust |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8بازه‌ها نیاز به بررسی دارند. |
tokioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| ammonia: mXSS via MathML `annotation-xml` encoding stripCVE-2026-63430 · GHSA-9JH8-V38H-CVHRبازه‌ها نیاز به بررسی دارند. |
ammoniaAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5بازه‌ها نیاز به بررسی دارند. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
کم
|
اصلاح گزارش شده |
|
| Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102342 · GHSA-M6MH-2HW2-555Xبازه‌ها نیاز به بررسی دارند. |
ammoniaAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the processCVE-2026-101911 · GHSA-H3MG-XC3C-68PW |
ip-addressCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
