Skip to contentRed Hat Developer Hub 1.10 vulnerabilities
- red hat agentic cluster security suite 0.2, cost management 4, advanced cluster security for kubernetes 4.11 +55 more +57 moreCa-certificates: distrust emudhra intermediate ca certificates due to security concernsCVE-2026-114406Fix available6.8 Medium
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676Fix available7.5 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +25 more +27 moreundici WebSocket client vulnerable to denial of service via fragment count bypassCVE-2026-12151Fix available7.5 High
- websockets ws, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 morews: Memory exhaustion DoS from tiny fragments and data chunksCVE-2026-48779Fix available7.5 High
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +62 more +64 moreAxios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionCVE-2026-44496Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Allocation of Resources Without Limits or Throttling in axiosCVE-2026-44488Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdapterCVE-2026-44487Fix available8.2 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionCVE-2026-44486Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +79 more +81 moreAxios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44495Fix available7.0 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`CVE-2026-44494Fix available8.7 High
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)CVE-2026-44492Fix availableEPSS 12.3%8.6 High
- shell-quote, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 moreshell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`CVE-2026-9277Public exploitFix available9.2 Critical
- js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 moreJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionCVE-2026-46625Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- beaugunderson ip-address, red hat confidential compute attestation, cryostat 4 +38 more +40 moreip-address: XSS in Address6 HTML-emitting methodsCVE-2026-42338Fix available5.3 Medium
- patriksimek vm2, red hat developer hub, developer hub 1.10 +1 more +3 morevm2: Sandbox Breakout Through InspectCVE-2026-24781Fix available9.8 Critical
- websockets ws, red hat cryostat 4, cryostat 4 on rhel 9 +47 more +49 morews: Uninitialized memory disclosureCVE-2026-45736Fix available4.4 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +21 more +23 moreundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentCVE-2026-9697Fix available7.4 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +19 more +21 moreundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuseCVE-2026-6734Fix available7.5 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +53 more +55 morefast-uri vulnerable to host confusion via percent-encoded authority delimitersCVE-2026-6322Fix available7.5 High