Skip to contentRed Hat Advanced Cluster Security 4 vulnerabilities
- github.com/jackc/pgproto3/v2, jackc pgproto3, red hat assisted installer for red hat openshift container platform 2 +26 more +28 moreDenial of service in github.com/jackc/pgproto3/v2CVE-2026-32286Public exploitFix available7.5 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 moreIncorrect enforcement of email constraints in crypto/x509CVE-2026-27137Fix available7.5 High
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 moreSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074Fix available7.5 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- docker compose, cli, command line interface +27 more +29 moreDocker Desktop Docker Plugins Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityCVE-2025-15558Fix available7.0 High
- rollup, red hat openshift pipelines, openshift service mesh 3 +26 more +28 moreRollup 4 has Arbitrary File Write via Path TraversalCVE-2026-27606Public exploitFix available8.8 High
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesCVE-2026-25896Fix available9.3 Critical
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)CVE-2026-25940Public exploitFix available8.1 High
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has PDF Object Injection via Unsanitized Input in addJS MethodCVE-2026-25755Public exploitFix available8.1 High
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF DimensionsCVE-2026-25535Fix available8.7 High
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)CVE-2026-26278Fix available7.5 High
- ajv.js ajv, red hat confidential compute attestation, cryostat 4 +67 more +69 moreajv has ReDoS when using `$data` optionCVE-2025-69873Fix available2.9 Low
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios affected by Denial of Service via __proto__ Key in mergeConfigCVE-2026-25639Fix available7.5 High
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 morejsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript ExecutionCVE-2026-24737Fix available8.1 High
- pypa wheel, red hat discovery 2 for rhel 10, discovery 2 for rhel 8 +57 more +59 morewheel Allows Arbitrary File Permission Modification via Path TraversalCVE-2026-24049Public exploitFix available7.1 High
- lodash, lodash lodash-amd, lodash-es +119 more +121 morePrototype Pollution Vulnerability in Lodash _.unset and _.omit functionsCVE-2025-13465Public exploitFix available6.9 Medium
- dabeaz ply, red hat fence agents remediation operator, migration toolkit for containers +25 more +27 moreAn undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code...CVE-2025-56005Public exploitFix availableDisputedEPSS 18.8%9.8 Critical
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- @tanstack react-router, remix-run @remix-run/router, red hat cryostat 4 +74 more +76 moreReact Router vulnerable to XSS via Open RedirectsCVE-2026-22029Fix available8.0 High
- @tanstack react-router, red hat cryostat 4, gatekeeper 3 +47 more +49 moreReact Router has Path Traversal in File Session StorageCVE-2025-61686Public exploitFix availableEPSS 17.3%9.1 Critical
- python urllib3, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift 1.18 +105 more +107 moreurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)CVE-2026-21441Fix available8.9 High
- parall jspdf, red hat advanced cluster security 4, advanced cluster security 4.8 +1 more +3 morejsPDF has Local File Inclusion/Path Traversal vulnerabilityCVE-2025-68428Public exploitFix available9.2 Critical
- red hat openshift pipelines, advanced cluster management for kubernetes 2, advanced cluster security 4 +12 more +14 moreGithub.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructureCVE-2025-11065Fix available5.3 Medium
- operator-framework operator-sdk, red hat multicluster engine for kubernetes, multicluster engine for kubernetes 2.6 +26 more +28 moreOperator-sdk: privilege escalation due to incorrect permissions of /etc/passwdCVE-2025-7195Fix available6.4 Medium
- red hat builds for red hat openshift, custom metric autoscaler operator for red hat openshift, multicluster global hub +24 more +26 moreGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsCVE-2025-8556Fix available3.7 Low
- stackrox, red hat advanced cluster security 4, redhat advanced cluster security +2 moreStackrox: xss in stackroxCVE-2025-51985.0 Medium
- red hat .net 6.0 on red hat enterprise linux, cryostat 3, logging subsystem for red hat openshift +52 more +54 moreNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptCVE-2024-11831Fix available5.4 Medium
- red hat multicluster engine for kubernetes, oadp-1.3-rhel-9, openshift developer tools and services +28 more +30 moreContainers/image: digest type does not guarantee valid typeCVE-2024-3727Fix available8.3 High
- mholt archiver, red hat advanced cluster security 3, advanced cluster security 4 +3 more +5 moreMholt/archiver: path traversal vulnerabilityCVE-2024-0406Public exploitFix available6.1 Medium
- redhat advanced cluster security, red hat advanced cluster security 3, advanced cluster security 4.2 +2 moreStackrox: missing http security headers allows for clickjacking in web uiCVE-2023-49586.1 Medium
- postgresql, red hat advanced cluster security 4.2, enterprise linux 6 +31 more +33 morePostgresql: role pg_signal_backend can signal certain superuser processes.CVE-2023-5870Fix available2.2 Low
- postgresql, red hat advanced cluster security 4.2, enterprise linux 6 +37 more +39 morePostgresql: buffer overrun from integer overflow in array modificationCVE-2023-5869Fix available8.8 High
- postgresql, red hat advanced cluster security 4.2, enterprise linux 6 +31 more +33 morePostgresql: memory disclosure in aggregate function callsCVE-2023-5868Fix available4.3 Medium
- postgresql, debian linux, red hat advanced cluster security 4.2 +19 more +21 morePostgresql: extension script @substitutions@ within quoting allow sql injectionCVE-2023-39417Fix available7.5 High
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical