Red Hat Security AdvisoryRHSA-2026:74609
Cluster Observability Operator 1.5.3
Released 2026-10-01 · Red Hat rating Important · View on Red Hat →
Fixes 21 records
Priority HIGH 78
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00608 · Published 2026-07-27 · Partial fix · 8.5.12 CWE-200
Priority HIGH 72
linkify-it is a links recognition library with full Unicode support.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-07-08 · Partial fix · 5.0.2 CWE-407
Priority HIGH 72
adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00841 · Published 2026-07-10 · Partial fix · 0.6.0 CWE-400
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00336 · Published 2026-06-04 · Partial fix · 1.42.0, 1.44.0 CWE-789
Priority MEDIUM 45
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00684 · Published 2026-09-15 · Partial fix · 0.6.1 CWE-409
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00641 · Published 2026-09-14 · Partial fix · 1.82.2, 1.83.2 +2 CWE-129
Priority MEDIUM 44
Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model to restrict file system reads to the project directory and configured mounts.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00356 · Published 2026-09-26 · Partial fix · 0.166.0 CWE-59
Priority MEDIUM 40
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00178 · Published 2026-09-04 · Partial fix · 7.29.1, 8.10.2 CWE-295
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0056 · Published 2026-06-02 · Partial fix · 1.25.11, 1.26.4 CWE-407
Priority LOW 39
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0038 · Published 2026-09-02 · Partial fix · 2.4.6, 3.1.7 +1 CWE-436
Priority LOW 39
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00398 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-436
Priority LOW 39
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00298 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +2 CWE-347
Priority LOW 39
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00394 · Published 2026-09-04 · Partial fix · 6.28.1, 7.29.1 +1 CWE-248
Priority LOW 38
fast-uri serializes the port component of a URI without validating it.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00239 · Published 2026-09-02 · Partial fix · 2.4.6, 3.1.7 +1 CWE-116
Priority LOW 38
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00232 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-177
Priority LOW 38
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0022 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-20
Priority LOW 38
fast-uri is a URI parser for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0022 · Published 2026-08-24 · Partial fix · 2.4.5, 3.1.6 +1 CWE-174
Priority LOW 37
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.
CVSS 3.1HIGH 8.4· Local · No auth · No interaction · EPSS 0.00129 · Published 2026-08-13 · Partial fix · 1.25.13, 1.26.6 +2 CWE-347
Priority LOW 36
Perses is an open-source dashboard and visualization project for observability data.
CVSS 4.0HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00267 · Published 2026-09-18 · Fixed in 0.54.0-rc.0 CWE-862
Priority LOW 34
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00296 · Published 2026-08-11 · Partial fix · 3.3.12, 5.1.11 CWE-190
Priority LOW 31
go-git is an extensible git implementation library written in pure Go.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00357 · Published 2026-08-07 · Partial fix · 5.19.2, 6.0.0-alpha.5 CWE-59
THREATIST.IORead the docs