Read the docs
Red Hat Security Advisory

RHSA-2026:24539

Red Hat Advanced Cluster Management for Kubernetes v2.15.3 security update

Released 2026-06-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 19 records

TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7

Server-side request forgery in axios

Priority HIGH 82

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00711 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-183
TI-2026-29546 CVE-2026-40890 · GHSA-77fj-vx54-gvh7

github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer

Priority HIGH 72

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00346 Published 2026-04-21 Fixed in 759bbc3e32073c3bc4e25969c132fc520eda2778, 0.0.0-20260411013819-759bbc3e3207 CWE-125
TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

Priority HIGH 68

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00403 Published 2026-04-24 Partial fix · 1.15.1, 0.31.1 CWE-113
TI-2026-26188 CVE-2026-33816 · GHSA-9jj7-4m8r-rfcm

CVE-2026-33816 in github.com/jackc/pgx

Priority MEDIUM 50

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00583 Published 2026-04-07 Partial fix · 5.9.0 CWE-20
TI-2026-26187 CVE-2026-33815 · GHSA-xgrm-4fwx-7qm8

CVE-2026-33815 in github.com/jackc/pgx

Priority MEDIUM 50

Memory-safety vulnerability in github.com/jackc/pgx/v5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00629 Published 2026-04-07 Partial fix · 5.9.0
TI-2026-30157 CVE-2026-41636 · GHSA-r67j-r569-jrwp

Apache Thrift: Node.js skip() recursion

Priority MEDIUM 44

Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00451 Published 2026-04-28 Partial fix · 0.23.0 CWE-674
TI-2026-30145 CVE-2026-41604 · GHSA-r4rx-ffxv-23vw

Apache Thrift: Swift Range crash in skip()

Priority MEDIUM 43

Out-of-bounds Read vulnerability in Apache Thrift.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00918 Published 2026-04-28 Partial fix · 0.23.0 CWE-125
TI-2026-30144 CVE-2026-41602 · GHSA-wf45-q9ch-q8gh

Apache Thrift: Go TFramedTransport uint32 overflow

Priority MEDIUM 41

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01163 Published 2026-04-28 Partial fix · 0.23.0 CWE-190
TI-2026-30148 CVE-2026-41607 · GHSA-7gqw-825c-3842

Apache Thrift: C++ JSON OOB read

Priority LOW 37

Out-of-bounds Read vulnerability in Apache Thrift.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00896 Published 2026-04-28 Partial fix · 0.23.0 CWE-125
TI-2026-29074 CVE-2026-40293 · GHSA-68m9-983m-f3v5

OpenFGA Playground Preshared Key Exposure

Priority LOW 35

OpenFGA is an authorization/permission engine built for developers.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00287 Published 2026-04-17 Partial fix · 1.14.0 CWE-200
TI-2026-30147 CVE-2026-41606 · GHSA-h5hj-56h4-rwcp

Apache Thrift: c_glib dispatch stack overflow

Priority LOW 32

Uncontrolled Recursion vulnerability in Apache Thrift.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01101 Published 2026-04-28 Partial fix · 0.23.0 CWE-674