Red Hat Security AdvisoryRHSA-2026:41941
Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
Released 2026-07-20 · Red Hat rating Important · View on Red Hat →
Fixes 22 records
Priority HIGH 79
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
CVSS 3.1CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00527 · Published 2026-02-20 · Partial fix · 5.3.5, 4.5.4 CWE-185
Priority HIGH 72
ws is an open source WebSocket client and server for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01426 · Published 2026-06-16 · Partial fix · 5.2.5, 6.2.4 +2 CWE-400
Priority HIGH 72
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00612 · Published 2026-03-20 · Partial fix · 5.5.6, 4.5.5 CWE-776
Priority HIGH 72
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00539 · Published 2026-02-11 · Partial fix · 6.14.0, 8.17.2 +1 CWE-1333
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00525 · Published 2026-02-26 · Partial fix · 10.2.3, 9.0.7 +6 CWE-1333
Priority MEDIUM 51
Webpack is a module bundler.
CVSS 3.1LOW 3.7· Network · Low privileges · User interaction · EPSS 0.0023 · Published 2026-02-05 · Partial fix · 5.104.1 CWE-918
Priority MEDIUM 51
Webpack is a module bundler.
CVSS 3.1LOW 3.7· Network · Low privileges · User interaction · EPSS 0.0023 · Published 2026-02-05 · Partial fix · 5.104.0 CWE-918
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01619 · Published 2026-03-20 · Partial fix · 1.79.3 CWE-285
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02808 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-94
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-03-06 · Partial fix · 3.8.3, 4.3.7 +2 CWE-1321
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-02-20 · Partial fix · 10.2.1, 9.0.6 +6 CWE-1333
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00446 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-674
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.0058 · Published 2025-11-25 · Partial fix · 1.3.2 CWE-436
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02292 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
Priority MEDIUM 41
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00937 · Published 2026-02-19 · Partial fix · 5.3.6, 4.5.4 CWE-776
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00663 · Published 2026-04-06 · Partial fix · 4.1.4, 3.0.5 CWE-248
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0049 · Published 2025-12-02 · Partial fix · 1.24.11, 1.25.5 CWE-295
Priority LOW 31
Cancelling a query (e.g.
CVSS 3.1HIGH 7.0· Network · No auth · No interaction · EPSS 0.00406 · Published 2025-08-07 · Partial fix · 1.23.12, 1.24.6 CWE-362
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2025-10-29 · Partial fix · 1.24.8, 1.25.2
Priority LOW 14
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
CVSS 4.0LOW 2.7· Network · No auth · No interaction · EPSS 0.00543 · Published 2026-02-26 · Partial fix · 5.3.8, 4.5.4 CWE-120
THREATIST.IORead the docs