Red Hat Security AdvisoryRHSA-2026:3712
Red Hat OpenShift Pipelines Release 1.15.4
Released 2026-03-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Pipelines 1.15 registry.redhat.io/openshift-pipelines/pipelines-chains-controller-rhel8, registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel8, registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel8 +2
Fixes 11 records
Priority HIGH 72
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00738 · Published 2025-08-20 · Partial fix · 2.4.12 CWE-20
Priority HIGH 72
Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0055 · Published 2025-08-20 · Partial fix · 1.0.5 CWE-20
Priority HIGH 72
Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00463 · Published 2025-06-23 · Partial fix · 3.1.3 CWE-20
Priority HIGH 72
Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00447 · Published 2025-06-23 · Partial fix · 3.1.3 CWE-20
Priority HIGH 72
ws is an open source WebSocket client and server for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01357 · Published 2024-06-17 · Partial fix · 5.2.4, 6.2.3 +2 CWE-476
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00446 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-674
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0058 · Published 2025-11-25 · Partial fix · 1.3.2 CWE-436
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 39
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00475 · Published 2025-12-04 · Partial fix · 2.0.3 CWE-405
Priority LOW 38
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00226 · Published 2025-12-04 · Partial fix · 1.8.3 CWE-405
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
THREATIST.IORead the docs