RHSA-2026:60388

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

form-data is a library for creating readable multipart/form-data streams.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

js-yaml is a JavaScript YAML parser and dumper.

axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments.

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js).

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

A flaw was found in the multicloud-integrations component.

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).

A flaw was found in search-v2-operator.

A flaw was found in the multicloud-operators-subscription component.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

A flaw was found in the multicloud-operators-subscription component.

A flaw was found in acm-search-v2-rhel9.

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM).

A flaw was found in the search-v2-operator.

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes.

containerd is an open-source container runtime.

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM).

A flaw was found in acm-search-v2-rhel9.

A flaw was found in search-v2-api.

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

A flaw was found in search-v2-operator.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards.

Prometheus is an open-source monitoring system and time series database.

A flaw was found in the `search-v2-operator` component.

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM).

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.

A flaw was found in insights-client.

A flaw was found in multicloud-operators-subscription.

A flaw was found in search-indexer.

A flaw was found in insights-client.

A flaw was found in insights-client.

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

Billy is an interface filesystem abstraction for Go.

A flaw was found in insights-client.

A flaw was found in the multicloud-operators-channel component.

A flaw was found in volsync-addon-controller.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.

A flaw was found in the Submariner operator.

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes.

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes.

A flaw was found in acm-search-v2-api-rhel9.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node…