Security
English
همهٔ محصولات

OpenShift Service Mesh 3/openshift-service-mesh/kiali-operator-bundle

Red Hat · بسته
73 گزارش
اطلاع‌رسانی آسیب‌پذیری
دنبال‌کردن
گزارشمحصولاکوسیستمشدتوضعیت اصلاحآخرین تغییر
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat متوسط اصلاح گزارش شده
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieCVE-2026-118777 · GHSA-6WVX-3R32-XMCG node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat متوسط اصلاح گزارش شده
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeCVE-2026-118780 · GHSA-4487-J8R4-4G2F node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat کم اصلاح گزارش شده
Forge: AES-GCM authentication bypass via unvalidated tagLength optionCVE-2026-119186 · GHSA-5CWG-6VW7-RJ6P node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat متوسط اصلاح گزارش شده
Forge: ASN.1 OID first arc truncation in asn1.oidToDerCVE-2026-118775 · GHSA-4642-5MCJ-2RQW node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat کم اصلاح گزارش شده
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)CVE-2026-118781 · GHSA-H6CR-WJV9-3CPP node-forgeNode HealthCheck Operator/workload-availability/node-healthcheck-must-gather-rhel9 npmRed Hat کم اصلاح گزارش شده
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118773 · GHSA-3G3M-2FJR-6PW4 globCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat متوسط اصلاح گزارش شده
i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)CVE-2026-115730 · GHSA-9JHJ-WVMW-CFX5 i18next-http-backendMigration Toolkit for Applications 8/mta/mta-ui-rhel9 npmRed Hat کم اصلاح گزارش شده
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringCVE-2026-118258 · GHSA-3CMX-XJWW-583X i18next-http-backendMigration Toolkit for Applications 8/mta/mta-ui-rhel9 npmRed Hat کم اصلاح گزارش شده
i18next-http-backend incomplete URL validation permits SSRFCVE-2026-105800 · GHSA-XVQ9-WJP8-HWQF i18next-http-backendMigration Toolkit for Applications 8/mta/mta-ui-rhel9 npmRed Hat کم اصلاح گزارش شده
moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-17495 · GHSA-4P3W-J4W9-5JQW momentMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 npmRed Hat متوسط اصلاح گزارش شده
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102277 · GHSA-Q2HR-2G5M-VWHR brace-expansionCost Management On Premise/costmanagement/costmanagement-ui-rhel10 npmRed Hat متوسط اصلاح گزارش شده
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)CVE-2026-53669 · GHSA-WRJC-X8RR-H8H6 react-routerCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat متوسط اصلاح گزارش شده
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)CVE-2026-13311 · GHSA-395F-4HP3-45GV shell-quoteCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat زیاد اصلاح گزارش شده
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat متوسط اصلاح گزارش شده
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat متوسط اصلاح گزارش شده
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsCVE-2026-44490 · GHSA-898C-Q2CR-XWHG axiosCryostat 4/axios npmRed Hat متوسط اصلاح گزارش شده
PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputCVE-2026-41305 · GHSA-QX2V-QP2M-JG93 postcssCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat متوسط اصلاح گزارش شده
@tootallnate/once vulnerable to Incorrect Control Flow ScopingCVE-2026-3449 · GHSA-VPQ2-C234-7XJ6 @tootallnate/onceConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat کم اصلاح گزارش شده
brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V brace-expansionCryostat 4/brace-expansion npmRed Hat متوسط اصلاح گزارش شده