Skip to contentRed Hat Openshift Dev Spaces vulnerabilities
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- beaugunderson ip-address, red hat confidential compute attestation, cryostat 4 +38 more +40 moreip-address: XSS in Address6 HTML-emitting methodsCVE-2026-42338Fix available5.3 Medium
- axios, red hat cryostat 4, gatekeeper 3 +45 more +47 moreAxios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijackingCVE-2026-42264Fix available7.4 High
- ruby net-imap, red hat 3scale api management platform 2, enterprise linux 10 +19 more +21 morenet-imap: Command Injection via unvalidated Symbol inputsCVE-2026-42258Fix available5.8 Medium
- websockets ws, red hat cryostat 4, cryostat 4 on rhel 9 +47 more +49 morews: Uninitialized memory disclosureCVE-2026-45736Fix available4.4 Medium
- spring boot, vmware spring boot, red hat amq broker 7 +14 more +16 moreSpring Boot's default security filter chain has no authorization rule with Actuator but without HealthCVE-2026-40976Fix available9.1 Critical
- spring boot, vmware spring boot, red hat hawtio hawtio 4.4.0 +14 more +16 moreSpring Boot's random value property source uses a weak PRNG unsuitable for secretsCVE-2026-40975Fix available4.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +61 more +63 moreAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataCVE-2026-42039Fix available6.9 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyCVE-2026-42041Fix available4.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +56 more +58 moreAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0CVE-2026-42043Fix available7.2 High
- axios, red hat cryostat 4, gatekeeper 3 +59 more +61 moreAxios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`CVE-2026-42044Fix available6.5 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033Fix available7.4 High
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: StripPrefixRegex auth bypass via Path/RawPath desyncCVE-2026-40912Fix available7.8 High
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: Forwarded alias spoofing top pre-auth decision bypassCVE-2026-39858Fix available7.8 High
- traefik, red hat openshift dev spaces 3.28 +1 moreTraefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authCVE-2026-35051Fix available7.8 High
- apache httpclient, red hat cryostat 4, migration toolkit for applications 8 +45 more +47 moreApache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verificationCVE-2026-40542Fix available7.3 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreervlet Path Not Correctly Included in Path Matching of XML Authorization RulesCVE-2026-22754Fix available7.5 High
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreUnauthorized User Impersonation when Using X.509 Client CertificatesCVE-2026-22747Public exploitFix available6.8 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +21 more +23 moreundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentCVE-2026-9697Fix available7.4 High
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +19 more +21 moreundici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuseCVE-2026-6734Fix available7.5 High
- protobufjs project protobufjs, protobufjs protobuf.js, red hat cryostat 4 +20 more +22 moreprotobufjs has an arbitrary code execution issueCVE-2026-41242Public exploitFix available9.4 Critical
- go-acme lego, red hat openshift dev spaces 3.28 +1 moreLego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 ProviderCVE-2026-40611Fix available8.8 High
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 moreImproper neutralization of specific syntax patterns for unauthorized expressions in ThymeleafCVE-2026-40478Known exploitedFix available9.1 Critical
- thymeleaf, red hat build of apache camel for spring boot 4, fuse 7 +7 more +9 moreImproper restriction of the scope of accessible objects in Thymeleaf expressionsCVE-2026-40477Known exploitedPublic exploitFix available9.1 Critical
- @fastify/reply-from @fastify/http-proxy, @fastify/reply-from, fastify reply-from +3 more +5 more@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headersCVE-2026-33805Fix available9.0 Critical
- legion of the bouncy castle inc. bc-java, bcpix-lts, bcpkix-fips +43 more +45 morePKIX draft CompositeVerifier accepts empty signature sequence as valid.CVE-2026-5588Fix available6.3 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +29 more +31 moreNon-constant time comparisons risk private key leakage in FrodoKEM.CVE-2026-5598Fix available8.9 High
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +42 more +44 moreLDAP Injection Vulnerability in LDAPStoreHelper.javaCVE-2026-0636Fix available5.5 Medium
- legion of the bouncy castle inc. bc-java, red hat cryostat 4, openshift developer tools and services +44 more +46 moreGOSTCTR implementation unable to process more than 255 blocks correctlyCVE-2025-14813Fix available9.3 Critical
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +39 more +41 moreHTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-2332Public exploitFix available7.4 High
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainCVE-2026-40175Public exploitFix available4.8 Medium
- axios, red hat cluster observability operator 1.5.0, cryostat 4 +60 more +62 moreAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFCVE-2025-62718Fix available6.3 Medium
- eclipse jetty, red hat hawtio hawtio 4.4.0, build of apache camel 4.18.1 for spring boot 3.5.14 +6 more +8 moreDuplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variablesCVE-2026-5795Fix available7.4 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810Fix available8.2 High
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +4 more +6 moreModel Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on LocalhostCVE-2026-34742Fix available7.6 High
- xmldom, red hat migration toolkit for applications 8, build of podman desktop +6 more +8 morexmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionCVE-2026-34601Fix available7.5 High
- lodash, lodash lodash-amd, lodash-es +105 more +107 morelodash vulnerable to Code Injection via `_.template` imports key namesCVE-2026-4800Public exploitFix available8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +11 more +13 moreHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and OptionsCVE-2026-33941Fix available8.3 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partialCVE-2026-33940Fix available8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +10 more +12 moreHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template CompilationCVE-2026-33939Fix available7.5 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockCVE-2026-33938Fix available8.1 High
- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +12 more +14 moreHandlebars.js has JavaScript Injection via AST Type ConfusionCVE-2026-33937Public exploitFix available9.8 Critical
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerFieldCVE-2026-33433Fix available5.1 Medium
- traefik, red hat openshift dev spaces 3.27 +1 moreTraefik has Knative Ingress Rule Injection that Allows Host Restriction BypassCVE-2026-32695Fix available6.3 Medium
- path-to-regexp, red hat cryostat 4, cryostat 4 on rhel 9 +49 more +51 morepath-to-regexp vulnerable to Denial of Service via sequential optional groupsCVE-2026-4926Fix available7.5 High
- traefik, red hat openshift dev spaces 3.27, openshift dev spaces 3.28 +1 more +3 moreTraefik mTLS bypass via fragmented ClientHello SNI extraction failureCVE-2026-32305Fix available7.8 High
- Show moreLoading…