Red Hat Security AdvisoryRHSA-2026:77321
OpenShift Container Platform 4.13.72 bug fix and security update
Released 2026-10-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-cluster-autoscaler-operator +10
Fixes 8 records
Priority HIGH 75
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00684 · Published 2026-06-12 · Partial fix · 2.17.4 CWE-79
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00585 · Published 2026-07-08 · Partial fix · 3.15.0, 4.3.0 CWE-407
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01619 · Published 2026-03-20 · Partial fix · 1.79.3 CWE-285
Priority MEDIUM 47
A flaw was found in the OpenShift console.
CVSS 3.1CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00733 · Published 2026-09-18 · Fixed in 1790102793, 1791299243 +9 CWE-918
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-02-20 · Partial fix · 10.2.1, 9.0.6 +6 CWE-1333
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0084 · Published 2026-05-07 · Partial fix · 0.53.0, 1.25.10 +1 CWE-835
Priority LOW 39
A flaw was found in the OpenShift console.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00529 · Published 2026-09-23 · Fixed in 1790102793, 1791299243 +9 CWE-22
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-704
THREATIST.IORead the docs