Red Hat Security AdvisoryRHSA-2026:47737
Red Hat Advanced Cluster Management for Kubernetes v2.13.10 security update
Released 2026-07-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +6
Fixes 11 records
Priority HIGH 75
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00684 · Published 2026-06-12 · Partial fix · 2.17.4 CWE-79
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00585 · Published 2026-07-08 · Partial fix · 3.15.0, 4.3.0 CWE-407
Priority HIGH 72
oras-go is a Go library for managing OCI artifacts.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00382 · Published 2026-07-17 · Partial fix · 2.6.1 CWE-918
Priority MEDIUM 57
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0691 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
Priority MEDIUM 50
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00556 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-863
Priority MEDIUM 47
Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04002 · Published 2026-06-09 · Partial fix · 4.0.1, 3.6.3 +5 CWE-416
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.01834 · Published 2026-05-22 · Partial fix · 1.25.13, 1.26.6 +2 CWE-1289
Priority MEDIUM 42
containerd is an open-source container runtime.
CVSS 4.0CRITICAL 9.4· Local · No auth · No interaction · EPSS 0.00176 · Published 2026-07-01 · Partial fix · 1.7.33, 2.0.10 +3 CWE-20
Priority LOW 30
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00591 · Published 2026-06-02 · Partial fix · 1.25.11, 1.26.4
Priority LOW 29
Billy is an interface filesystem abstraction for Go.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00389 · Published 2026-06-01 · Partial fix · 5.9.0, 6.0.0-alpha.1 CWE-674
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00223 · Published 2026-05-22 · Partial fix · 0.55.0 CWE-1021
THREATIST.IORead the docs