Red Hat Security AdvisoryRHSA-2026:12277
Red Hat OpenShift Data Foundation 4.20.10 security, enhancement & bug fix update
Released 2026-04-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
Fixes 5 records
Priority HIGH 72
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00612 · Published 2026-03-20 · Partial fix · 5.5.6, 4.5.5 CWE-776
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01619 · Published 2026-03-20 · Partial fix · 1.79.3 CWE-285
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02808 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-94
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00663 · Published 2026-04-06 · Partial fix · 4.1.4, 3.0.5 CWE-248
Priority LOW 14
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
CVSS 4.0LOW 2.7· Network · No auth · No interaction · EPSS 0.00543 · Published 2026-02-26 · Partial fix · 5.3.8, 4.5.4 CWE-120
THREATIST.IORead the docs