Skip to contentRed Hat Advanced Cluster Management For Kubernetes 2 vulnerabilities
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCVE-2026-40175Public exploitFix available4.8 Medium
- axios, red hat cluster observability operator 1.5.0, cryostat 4 +60 more +62 moreAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFCVE-2025-62718Fix available6.3 Medium
- openfga, red hat multicluster global hub 1.7.0, advanced cluster management for kubernetes 2.14 +3 more +5 moreOpenFGA Playground Preshared Key ExposureCVE-2026-40293Fix available6.5 Medium
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810Fix available8.2 High
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +7 more +9 moreOpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)CVE-2026-29181Fix available7.5 High
- jackc pgx, github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3, red hat cryostat 4 on rhel 9 +29 more +31 moreCVE-2026-33816 in github.com/jackc/pgxCVE-2026-33816Fix available9.8 Critical
- jackc pgx, github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3, red hat cryostat 4 on rhel 9 +28 more +30 moreCVE-2026-33815 in github.com/jackc/pgxCVE-2026-33815Fix available9.8 Critical
- distribution, red hat multicluster engine for kubernetes, advanced cluster management for kubernetes 2 +7 more +9 moreDistribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidationCVE-2026-35172Fix available7.5 High
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- openbsd openssh, red hat multicluster engine for kubernetes, openshift pipelines +29 more +31 moreIn OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome...CVE-2026-35385Fix available7.5 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- moby, docker engine, red hat multicluster engine for kubernetes +7 more +9 moreMoby: Off-by-one error in plugin privilege validationCVE-2026-33997Fix available6.8 Medium
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926Fix available7.5 High
- webreflection flatted, red hat cluster observability operator 1.5.0, cryostat 4 +29 more +31 moreflatted: Prototype Pollution via parse()CVE-2026-33228Fix available8.9 High
- goxmldsig project goxmldsig, red hat multicluster global hub 1.3.4, multicluster global hub 1.4.5 +10 more +12 moregoxmldsig has validateSignature Loop Variable Capture Signature BypassCVE-2026-33487Fix available7.5 High
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical
- github.com/buger/jsonparser, jsonparser project jsonparser, red hat cluster observability operator 1.5.0 +17 more +19 moreDenial of service in github.com/buger/jsonparserCVE-2026-32285Fix available7.5 High
- github.com/jackc/pgproto3/v2, jackc pgproto3, red hat assisted installer for red hat openshift container platform 2 +26 more +28 moreDenial of service in github.com/jackc/pgproto3/v2CVE-2026-32286Public exploitFix available7.5 High
- debian linux, openbsd openssh, canonical ubuntu linux +39 more +41 moreVulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This...CVE-2026-3497Fix available2.7 Low
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 moreIncorrect enforcement of email constraints in crypto/x509CVE-2026-27137Fix available7.5 High
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS ACL BypassCVE-2026-26017Fix available7.7 High
- coredns, red hat advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreCoreDNS Loop Detection Denial of Service VulnerabilityCVE-2026-26018Fix available7.5 High
- isaacs node-tar, tar, red hat cryostat 4 +20 more +22 morenode-tar: Hardlink Path Traversal via Drive-Relative LinkpathCVE-2026-29786Public exploitFix available8.2 High
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 moreSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074Fix available7.5 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- docker compose, cli, command line interface +27 more +29 moreDocker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityCVE-2025-15558Fix available7.0 High
- angular, red hat advanced cluster management for kubernetes 2, enterprise linux 10 +5 more +7 moreAngular i18n vulnerable to Cross-Site Scripting (XSS)CVE-2026-27970Fix available7.6 High
- ajv.js ajv, red hat confidential compute attestation, cryostat 4 +67 more +69 moreajv has ReDoS when using `$data` optionCVE-2025-69873Fix available2.9 Low
- cryptography.io cryptography, red hat openshift lightspeed, advanced cluster management for kubernetes 2 +23 more +25 morecryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesCVE-2026-26007Fix available8.2 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios affected by Denial of Service via __proto__ Key in mergeConfigCVE-2026-25639Fix available7.5 High
- isaacs node-tar, tar, red hat cryostat 4 +27 more +29 morenode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalCVE-2026-24842Fix available8.2 High
- grafana, grafana grafana/grafana, grafana/grafana-enterprise +12 more +14 moreDashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege EscalationCVE-2026-21721Public exploitFix available8.1 High
- cli, red hat confidential compute attestation, cryostat 4 +32 more +34 morenpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityCVE-2026-0775Fix available7.0 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- isaacs node-tar, tar, red hat confidential compute attestation +37 more +39 morenode-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFSCVE-2026-23950Fix available8.8 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 moreReact Router vulnerable to XSS via Open RedirectsCVE-2026-22029Fix available8.0 High
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session StorageCVE-2025-61686Public exploitFix availableEPSS 17.3%9.1 Critical
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- nodemailer, red hat advanced cluster management for kubernetes 2, ceph storage 8 +4 more +6 moreNodemailer: nodemailer: denial of service via crafted email address headerCVE-2025-14874Fix available7.5 High
- nodemailer, red hat advanced cluster management for kubernetes 2, ceph storage 8.1 +1 more +3 moreNodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflictCVE-2025-13033Fix available7.5 High
- red hat multicluster global hub, openshift serverless, advanced cluster management for kubernetes 2 +1 more +3 moreNx: nx/devkit: malicious versions of nx and plugins published to npmCVE-2025-10894Public exploit9.6 Critical
- red hat openshift pipelines, advanced cluster management for kubernetes 2, advanced cluster security 4 +12 more +14 moreGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructureCVE-2025-11065Fix available5.3 Medium
- operator-framework operator-sdk, red hat multicluster engine for kubernetes, multicluster engine for kubernetes 2.6 +26 more +28 moreOperator-sdk: privilege escalation due to incorrect permissions of /etc/passwdCVE-2025-7195Fix available6.4 Medium
- red hat advanced cluster management for kubernetes 2.11 for rhel 9, advanced cluster management for kubernetes 2.12 for rhel 9, redhat advanced cluster management for kubernetes +2 moreRhacm: users with clusterreader role can see credentials from managed-clustersCVE-2025-60175.5 Medium
- red hat builds for red hat openshift, custom metric autoscaler operator for red hat openshift, multicluster global hub +24 more +26 moreGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsCVE-2025-8556Fix available3.7 Low
- Show moreLoading…