Skip to contentRed Hat 3scale Api Management Platform 2 vulnerabilities
- isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 morenode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSCVE-2026-23950Fix available8.8 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- 3scale porta, red hat 3scale api management platform 2 +1 more3scale-porta: readonly fields not validated server-sideCVE-2024-121257.5 High
- rails activestorage, red hat 3scale api management platform 2, satellite 6 +2 moreActive Storage allowed transformation methods that were potentially unsafeCVE-2025-24293Public exploitFix available9.2 Critical
- ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +17 more +19 morenet-imap vulnerable to STARTTLS stripping via invalid response timingCVE-2026-42246Fix available7.6 High
- red hat cert-manager operator for red hat openshift 1.16, openshift file integrity operator - fio 1, 3scale api management platform 2 +43 more +45 moreLibxml: heap use after free (uaf) leads to denial of service (dos)CVE-2025-49794Fix available9.1 Critical
- red hat .net 6.0 on red hat enterprise linux, cryostat 3, logging subsystem for red hat openshift +52 more +54 moreNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptCVE-2024-11831Fix available5.4 Medium
- red hat 3scale api management platform 2, redhat 3scale api management +1 moreGateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a requestCVE-2024-102957.5 High
- red hat 3scale api management platform 2, redhat 3scale api management platform +1 moreSystem: pdf invoices of the developer users can be seen if the url is knownCVE-2024-96715.3 Medium
- redhat 3scale, red hat 3scale api management platform 2 +1 moreApicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versionsCVE-2024-05606.3 Medium
- red hat 3scale api management platform 2, redhat 3scale api management +1 more3scale-admin-portal: logged out users tokens can be accessedCVE-2023-49105.5 Medium
- fedora, red hat 3scale api management platform 2, rmagick +2 moreDraw while calling getdrawinfo()CVE-2023-5349Fix available5.3 Medium
- redhat apicast, red hat 3scale api management platform 2 +1 moreApicast proxies the api call with incorrect jwt token to the api backend without proper authorization checkCVE-2023-04567.4 High
- isaacs node-tar, tar, red hat confidential compute attestation +40 more +42 morenode-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path SanitizationCVE-2026-23745Public exploitFix available8.2 High
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical