Skip to contentRed Hat Self-service Automation Portal 2 vulnerabilities
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 moreSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)CVE-2026-29074Fix available7.5 High
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- expressjs multer, red hat developer hub 1.8, developer hub 1.9 +1 more +3 moreMulter vulnerable to Denial of Service via uncontrolled recursionCVE-2026-3520Fix available8.7 High
- expressjs multer, red hat logging subsystem for red hat openshift, developer hub 1.8 +7 more +9 moreMulter vulnerable to Denial of Service via incomplete cleanupCVE-2026-3304Public exploitFix available8.7 High
- expressjs multer, red hat logging subsystem for red hat openshift, developer hub 1.8 +7 more +9 moreMulter vulnerable to Denial of Service via resource exhaustionCVE-2026-2359Fix available8.7 High
- koajs koa, red hat developer hub, openshift ai (rhoai) +4 more +6 moreKoa has Host Header Injection via `ctx.hostname`CVE-2026-27959Public exploitFix available7.5 High
- rollup, red hat openshift pipelines, openshift service mesh 3 +26 more +28 moreRollup 4 has Arbitrary File Write via Path TraversalCVE-2026-27606Public exploitFix available8.8 High
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesCVE-2026-25896Fix available9.3 Critical
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 morefast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)CVE-2026-26278Fix available7.5 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios affected by Denial of Service via __proto__ Key in mergeConfigCVE-2026-25639Fix available7.5 High
- red hat migration toolkit for virtualization, openshift pipelines, ansible automation platform 2 +8 more +10 morejsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path ExpressionsCVE-2026-1615Fix available9.2 Critical
- backstage, red hat developer hub 1.8, developer hub 1.9 +1 more +3 more@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooksCVE-2026-25153Fix available7.7 High
- dchester jsonpath, red hat migration toolkit for virtualization, openshift pipelines +11 more +13 moreJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.jsCVE-2025-61140Fix available9.8 Critical
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +53 more +55 morefast-uri vulnerable to host confusion via percent-encoded authority delimitersCVE-2026-6322Fix available7.5 High