Skip to contentRed Hat Ansible Automation Platform 2.6 vulnerabilities
- protobufjs project protobufjs, protobufjs protobuf.js, red hat openshift pipelines +20 more +22 moreprotobufjs: Code injection through bytes field defaults in generated toObject codeCVE-2026-44293Fix available7.7 High
- python urllib3, red hat exploit intelligence, external secrets operator for red hat openshift +48 more +50 moreurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APICVE-2026-44432Fix available8.9 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- kludex python-multipart, red hat exploit intelligence, openshift lightspeed +11 more +13 morePython-Multipart: Denial of Service via unbounded multipart part headersCVE-2026-42561Fix available7.5 High
- beaugunderson ip-address, red hat confidential compute attestation, cryostat 4 +38 more +40 moreip-address: XSS in Address6 HTML-emitting methodsCVE-2026-42338Fix available5.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofingCVE-2026-123828.2 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +1 more +3 moreAap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linkingCVE-2026-62668.3 High
- websockets ws, red hat cryostat 4, cryostat 4 on rhel 9 +47 more +49 morews: Uninitialized memory disclosureCVE-2026-45736Fix available4.4 Medium
- pallets click click, red hat ansible automation platform 2, ansible automation platform 2.5 for rhel 8 +3 more +5 more[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"CVE-2026-7246Fix availableDisputed7.2 High
- python-poetry poetry, red hat ansible automation platform 2, ansible automation platform 2.6 +3 more +5 morePoetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4CVE-2026-41140Fix available0.6 Low
- python pillow, red hat lightspeed core, openshift lightspeed +27 more +29 morePillow is vulnerable to a FITS GZIP decompression bombCVE-2026-40192Fix available8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCVE-2026-40175Public exploitFix available4.8 Medium
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +2 more +4 moreDuplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrailCVE-2026-40217Public exploitFix availableEPSS 17.0%8.8 High
- axios, red hat cluster observability operator 1.5.0, cryostat 4 +60 more +62 moreAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFCVE-2025-62718Fix available6.3 Medium
- cryptography.io cryptography, red hat lightspeed core, migration toolkit for applications 8 +28 more +30 morecryptography has a buffer overflow if non-contiguous buffers were passed to APIsCVE-2026-39892Fix available6.9 Medium
- redhat ansible automation platform, red hat ansible automation platform 2, ansible automation platform 2.16 +5 more +7 moreAnsible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissionsCVE-2025-578476.4 Medium
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810Fix available8.2 High
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +9 more +11 moreVite has a `server.fs.deny` bypass with queriesCVE-2026-393648.2 High
- vitejs vite, red hat advanced cluster security 4, ansible automation platform 2 +13 more +15 moreVite Affected by Arbitrary File Read via Vite Dev Server WebSocketCVE-2026-39363Public exploitFix available8.2 High
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +3 more +5 moreLiteLLM has an authentication bypass via OIDC userinfo cache key collisionCVE-2026-35030Public exploitFix available9.4 Critical
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +3 more +5 moreLiteLLM affected by privilege escalation via unrestricted proxy configuration endpointCVE-2026-35029Public exploitFix availableEPSS 38.6%8.7 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +17 more +19 moreForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputCVE-2026-33891Fix available7.5 High
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926Fix available7.5 High
- pyasn1, red hat migration toolkit for containers, migration toolkit for virtualization +40 more +42 morepyasn1 Vulnerable to Denial of Service via Unbounded RecursionCVE-2026-30922Fix available7.5 High
- pyca pyopenssl, red hat confidential compute attestation, exploit intelligence +37 more +39 morepyOpenSSL DTLS cookie callback buffer overflowCVE-2026-27459Fix available7.2 High
- authlib, red hat lightspeed core, ansible automation platform 2 +7 more +9 moreAuthlib: Fail-Open Cryptographic Verification in OIDC Hash BindingCVE-2026-28498Fix available8.2 High
- jpadilla pyjwt, red hat openshift lightspeed, ai inference server +27 more +29 morePyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)CVE-2026-32597Fix available7.5 High
- psf black, red hat openshift lightspeed, ansible automation platform 2 +6 more +8 moreBlack: Arbitrary file writes from unsanitized user input in cache file nameCVE-2026-32274Fix available8.7 High
- quinn-rs quinn, red hat confidential compute attestation, logging subsystem for red hat openshift +13 more +15 moreQuinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsingCVE-2026-31812Fix available8.7 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 moreIncorrect enforcement of email constraints in crypto/x509CVE-2026-27137Fix available7.5 High
- python-markdown markdown, red hat external secrets operator for red hat openshift, multicluster engine for kubernetes +27 more +29 morePython-Markdown has an Uncaught ExceptionCVE-2025-69534Fix available7.5 High
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 moreSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074Fix available7.5 High
- authlib, red hat ansible automation platform 2.6, quay 3.10 +5 more +7 moreAuthlib: Setting `alg: none` and a blank signature appears to bypass signature verificationCVE-2026-28802Fix available7.7 High
- rollup, red hat openshift pipelines, openshift service mesh 3 +26 more +28 moreRollup 4 has Arbitrary File Write via Path TraversalCVE-2026-27606Public exploitFix available8.8 High
- python pillow, red hat openshift lightspeed, ai inference server +24 more +26 morePillow has an out-of-bounds write when loading PSD imagesCVE-2026-25990Fix available8.6 High
- ajv.js ajv, red hat confidential compute attestation, cryostat 4 +67 more +69 moreajv has ReDoS when using `$data` optionCVE-2025-69873Fix available2.9 Low
- cryptography.io cryptography, red hat openshift lightspeed, advanced cluster management for kubernetes 2 +23 more +25 morecryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesCVE-2026-26007Fix available8.2 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios affected by Denial of Service via __proto__ Key in mergeConfigCVE-2026-25639Fix available7.5 High
- red hat migration toolkit for virtualization, openshift pipelines, ansible automation platform 2 +8 more +10 morejsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path ExpressionsCVE-2026-1615Fix available9.2 Critical
- red hat ansible automation platform 2, ansible automation platform 2.6 +1 moreAnsible-lightspeed: broken object level authorization leading to cross-user ai conversation context injection in ansible lightspeed apiCVE-2026-05984.2 Medium
- lfprojects mcp typescript sdk, modelcontextprotocol typescript-sdk, red hat ansible automation platform 2.6 +2 more@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCVE-2026-25536Fix available7.1 High
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection via QuerySet.order_by and FilteredRelationCVE-2026-1312Public exploitFix available5.4 Medium
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection in column aliases via control charactersCVE-2026-1287Fix available5.4 Medium
- djangoproject django, red hat ansible automation platform 2, ansible automation platform 2.5 +15 more +17 morePotential SQL injection via raster lookups on PostGISCVE-2026-1207Public exploitFix availableEPSS 12.8%5.4 Medium
- Show moreLoading…