Red Hat Security AdvisoryRHSA-2026:67936
OpenShift Container Platform 4.16.71 bug fix and security update
Released 2026-09-24 · Red Hat rating Important · View on Red Hat →
Fixes 16 records
Priority HIGH 78
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00608 · Published 2026-07-27 · Partial fix · 8.5.12 CWE-200
Priority HIGH 77
linkify-it is a links recognition library with full Unicode support.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00394 · Published 2026-07-14 · Partial fix · 5.0.1 CWE-1333
Priority HIGH 75
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00684 · Published 2026-06-12 · Partial fix · 2.17.4 CWE-79
Priority MEDIUM 61
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00451 · Published 2026-08-03 · Partial fix · 8.5.19, 8.5.23 CWE-200
Priority MEDIUM 40
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00568 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +1 CWE-770
Priority MEDIUM 40
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00568 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +1 CWE-770
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0056 · Published 2026-06-02 · Partial fix · 1.25.11, 1.26.4 CWE-407
Priority MEDIUM 40
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00568 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +1 CWE-400
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0084 · Published 2026-05-07 · Partial fix · 0.53.0, 1.25.10 +1 CWE-835
Priority MEDIUM 40
golang-jwt is a Go implementation of JSON Web Tokens.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00811 · Published 2025-03-21 · Partial fix · 4.5.2, 5.2.2 CWE-405
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00475 · Published 2026-07-21 · Partial fix · 0.39.0 CWE-835
Priority LOW 39
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0.
CVSS 3.1HIGH 8.0· Adjacent network · Low privileges · No interaction · EPSS 0.00983 · Published 2026-05-01 · Partial fix · 10.2.3, 11.2.1 +2 CWE-829
Priority LOW 34
In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the…
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00475 · Published 2026-07-24 · Partial fix CWE-78
Priority LOW 27
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0055 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +1 CWE-407
Priority LOW 27
Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0031 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +1 CWE-79
Priority LOW 25
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
CVSS 3.1MEDIUM 5.5· Network · High privileges · No interaction · EPSS 0.00408 · Published 2026-07-10 · Partial fix · 29.0.6, 32.0.2 +2 CWE-862
THREATIST.IORead the docs