Red Hat Security AdvisoryRHSA-2026:51349
General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
Released 2026-08-06 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
Fixes 10 records
Priority HIGH 79
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
CVSS 3.1CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00527 · Published 2026-02-20 · Partial fix · 5.3.5, 4.5.4 CWE-185
Priority HIGH 75
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00684 · Published 2026-06-12 · Partial fix · 2.17.4 CWE-79
Priority HIGH 72
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00612 · Published 2026-03-20 · Partial fix · 5.5.6, 4.5.5 CWE-776
Priority HIGH 72
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00612 · Published 2026-01-30 · Partial fix · 5.3.4 CWE-20
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00525 · Published 2026-02-26 · Partial fix · 10.2.3, 9.0.7 +6 CWE-1333
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-02-20 · Partial fix · 10.2.1, 9.0.6 +6 CWE-1333
Priority MEDIUM 41
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00937 · Published 2026-02-19 · Partial fix · 5.3.6, 4.5.4 CWE-776
Priority MEDIUM 40
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00692 · Published 2026-06-29 · Partial fix · 4.0.1, 3.1.3 +1 CWE-436
Priority MEDIUM 40
brace-expansion through 5.0.6 is vulnerable to denial of service.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.00364 · Published 2026-06-30 · Partial fix · 5.0.7, 1.1.16 +1 CWE-400
Priority LOW 14
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
CVSS 4.0LOW 2.7· Network · No auth · No interaction · EPSS 0.00543 · Published 2026-02-26 · Partial fix · 5.3.8, 4.5.4 CWE-120
THREATIST.IORead the docs