Skip to contentRed Hat Migration Toolkit For Virtualization vulnerabilities
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +17 more +19 moreAnsible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rceCVE-2026-845036.7 Medium
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +12 more +14 moreAnsible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)CVE-2026-1230376.7 Medium
- red hat migration toolkit for applications 8, migration toolkit for containers, migration toolkit for virtualization +12 more +14 moreAnsible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionCVE-2026-929828.5 High
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +15 more +17 moreAnsible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionCVE-2026-89091Fix available8.8 High
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +29 more +31 moreAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionCVE-2026-11332Fix available7.8 High
- pip maintainers pip, red hat exploit intelligence, lightspeed core +34 more +36 morepip can extract console_scripts and gui_scripts outside installation directoryCVE-2026-8643Fix available4.1 Medium
- python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 moreurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APICVE-2026-44432Fix available8.9 High
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +4 more +6 moreModel Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on LocalhostCVE-2026-34742Fix available7.6 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926Fix available7.5 High
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Missing cryptographic validation during DSA signing enables private key extractionCVE-2026-4601Fix available9.4 Critical
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce GenerationCVE-2026-4599Fix available9.3 Critical
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputsCVE-2026-4598Fix available8.7 High
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: Negative Exponent Handling Leads to Signature Verification BypassCVE-2026-4602Fix available8.7 High
- kjur jsrsasign, red hat migration toolkit for virtualization 2.1, migration toolkit for virtualization 2.9 +5 more +7 morejsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublicCVE-2026-4600Fix available9.1 Critical
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical
- pyasn1, red hat migration toolkit for containers, migration toolkit for virtualization +40 more +42 morepyasn1 Vulnerable to Denial of Service via Unbounded RecursionCVE-2026-30922Fix available7.5 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +3 more +5 moreMCP Go SDK Vulnerable to Improper Handling of Case SensitivityCVE-2026-27896Fix available7.0 High
- red hat migration toolkit for virtualization, openshift pipelines, ansible automation platform 2 +8 more +10 morejsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path ExpressionsCVE-2026-1615Fix available9.2 Critical
- dchester jsonpath, red hat migration toolkit for virtualization, openshift pipelines +11 more +13 moreJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.jsCVE-2025-61140Fix available9.8 Critical
- pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 morewheel Allows Arbitrary File Permission Modification via Path TraversalCVE-2026-24049Public exploitFix available7.1 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- dabeaz ply, red hat fence agents remediation operator, migration toolkit for containers +25 more +27 moreAn undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...CVE-2025-56005Public exploitFix availableDisputedEPSS 18.8%9.8 Critical
- pyasn1, debian linux, red hat lightspeed core +48 more +50 morepyasn1 has a DoS vulnerability in decoderCVE-2026-23490Fix available7.5 High
- @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 moreReact Router vulnerable to XSS via Open RedirectsCVE-2026-22029Fix available8.0 High
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session StorageCVE-2025-61686Public exploitFix availableEPSS 17.3%9.1 Critical
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- red hat .net 6.0 on red hat enterprise linux, cryostat 3, logging subsystem for red hat openshift +52 more +54 moreNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptCVE-2024-11831Fix available5.4 Medium
- red hat migration toolkit for virtualization 2.6Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authenticationCVE-2024-85097.5 High