Red Hat Security AdvisoryRHSA-2026:59566
Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3
Released 2026-08-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
Fixes 13 records
Priority HIGH 78
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00608 · Published 2026-07-27 · Partial fix · 8.5.12 CWE-200
Priority HIGH 75
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.00465 · Published 2026-08-03 · Partial fix · 10.3.1 CWE-20
Priority HIGH 72
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00658 · Published 2026-08-11 · Partial fix · 4.28.7 CWE-1321
Priority HIGH 72
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00647 · Published 2026-08-03 · Partial fix · 1.1.18, 2.1.4 +2 CWE-400
Priority HIGH 70
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00534 · Published 2026-08-01 · Partial fix · 0.33.0, 1.18.0 CWE-674
Priority HIGH 70
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00401 · Published 2026-07-27 · Partial fix · 10.2.1 CWE-20
Priority HIGH 67
axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00521 · Published 2026-08-01 · Fixed in 1.18.0, 0.33.0 CWE-400
Priority MEDIUM 61
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00451 · Published 2026-08-03 · Partial fix · 8.5.19, 8.5.23 CWE-200
Priority MEDIUM 61
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00411 · Published 2026-08-01 · Partial fix · 1.18.0 CWE-1321
Priority MEDIUM 40
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00655 · Published 2026-08-11 · Partial fix · 4.28.7 CWE-770
Priority MEDIUM 40
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00643 · Published 2026-07-23 · Partial fix · 5.0.8, 3.0.3 +2 CWE-400
Priority LOW 37
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.
CVSS 4.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.00523 · Published 2026-08-01 · Partial fix · 0.33.0, 1.18.0 CWE-200
Priority LOW 33
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.003 · Published 2026-05-29 · Partial fix · 5.0.6 CWE-400
THREATIST.IORead the docs