Red Hat Security AdvisoryRHSA-2026:17469
OpenShift Container Platform 4.20.23 security and extras update
Released 2026-05-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9
Fixes 6 records
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02808 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-94
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-03-06 · Partial fix · 3.8.3, 4.3.7 +2 CWE-1321
Priority MEDIUM 45
spdystream is a Go library for multiplexing streams over SPDY connections.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00656 · Published 2026-04-16 · Partial fix · 0.5.1 CWE-770
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 38
React Router is a router for React.
CVSS 3.1HIGH 8.0· Network · No auth · User interaction · EPSS 0.00866 · Published 2026-01-10 · Partial fix · 7.12.0, 1.23.2 CWE-79
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
THREATIST.IORead the docs