Skip to contentRed Hat Advanced Cluster Security 4.8 vulnerabilities
- moby spdystream, red hat cert-manager operator for red hat openshift, cluster observability operator 1.5.0 +44 more +46 moreSpdyStream: DOS on CRICVE-2026-35469Fix available8.7 High
- jackc pgx, github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3, red hat cryostat 4 on rhel 9 +29 more +31 moreCVE-2026-33816 in github.com/jackc/pgxCVE-2026-33816Fix available9.8 Critical
- jackc pgx, github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3, red hat cryostat 4 on rhel 9 +28 more +30 moreCVE-2026-33815 in github.com/jackc/pgxCVE-2026-33815Fix available9.8 Critical
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has HTML Injection in New Window pathsCVE-2026-31938Fix available9.6 Critical
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has a PDF Object Injection via FreeText colorCVE-2026-31898Fix available8.1 High
- github.com/jackc/pgproto3/v2, jackc pgproto3, red hat assisted installer for red hat openshift container platform 2 +26 more +28 moreDenial of service in github.com/jackc/pgproto3/v2CVE-2026-32286Public exploitFix available7.5 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 moreSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074Fix available7.5 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesCVE-2026-25896Fix available9.3 Critical
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)CVE-2026-25940Public exploitFix available8.1 High
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has PDF Object Injection via Unsanitized Input in addJS MethodCVE-2026-25755Public exploitFix available8.1 High
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF DimensionsCVE-2026-25535Fix available8.7 High
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)CVE-2026-26278Fix available7.5 High
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 morejsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript ExecutionCVE-2026-24737Fix available8.1 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 moreReact Router vulnerable to XSS via Open RedirectsCVE-2026-22029Fix available8.0 High
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 morejsPDF has Local File Inclusion/Path Traversal vulnerabilityCVE-2025-68428Public exploitFix available9.2 Critical