| minimatch has potential denial of service via globparts amplificationCVE-2026-118764 · GHSA-G3HV-75WG-M249 |
minimatchCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2025-13465 · GHSA-XXJR-MMJV-4GPG |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 |
globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Handlebars: JavaScript Injection via Own Property Check BypassCVE-2026-106445 · GHSA-P8WG-VRV2-V86F |
handlebarsNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)CVE-2026-106446 · GHSA-8R5X-FM3F-WHWJ |
handlebarsNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 |
npmRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102278 · GHSA-QHR7-859C-M2P7 |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102276 · GHSA-6J4F-FJ2G-MC7P |
brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`CVE-2026-88059 · GHSA-P297-FM68-3Q8C |
@angular/commonA-MQ Interconnect 1/qpid-dispatch |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerCVE-2026-88057 · GHSA-HH8M-FM6V-7CVG |
@angular/compiler@angular/core |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| adm-zip: Crafted ZIP file triggers 4GB memory allocationCVE-2026-39244 · GHSA-XCPC-8H2W-3J85 |
adm-zipRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/volsync-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH |
tarConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputCVE-2026-41305 · GHSA-QX2V-QP2M-JG93 |
postcssCryostat 4/cryostat-openshift-console-plugin-npm |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackCVE-2026-27601 · GHSA-QPX9-HPMF-5GMW |
underscoreLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationCVE-2026-33939 · GHSA-9CX6-37PM-9JFF |
handlebarsLogging Subsystem for Red Hat OpenShift/openshift-logging/elasticsearch-operator-bundle |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V |
brace-expansionCryostat 4/brace-expansion |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| AngularJS improperly sanitizes SVG elementsCVE-2025-0716 · GHSA-J58C-WW9W-PWP5 |
angularLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
کم
|
اصلاح اعلام نشده |
|
