Red Hat Security AdvisoryRHSA-2026:83619
Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update
Released 2026-10-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
Fixes 13 records
Priority HIGH 72
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00539 · Published 2026-02-11 · Partial fix · 6.14.0, 8.17.2 +1 CWE-1333
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00525 · Published 2026-02-26 · Partial fix · 10.2.3, 9.0.7 +6 CWE-1333
Priority MEDIUM 51
Webpack is a module bundler.
CVSS 3.1LOW 3.7· Network · Low privileges · User interaction · EPSS 0.0023 · Published 2026-02-05 · Partial fix · 5.104.1 CWE-918
Priority MEDIUM 51
Webpack is a module bundler.
CVSS 3.1LOW 3.7· Network · Low privileges · User interaction · EPSS 0.0023 · Published 2026-02-05 · Partial fix · 5.104.0 CWE-918
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01619 · Published 2026-03-20 · Partial fix · 1.79.3 CWE-285
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02808 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-94
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00577 · Published 2026-02-20 · Partial fix · 10.2.1, 9.0.6 +6 CWE-1333
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00446 · Published 2025-11-26 · Partial fix · 1.3.2 CWE-674
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02292 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00663 · Published 2026-04-06 · Partial fix · 4.1.4, 3.0.5 CWE-248
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0084 · Published 2026-05-07 · Partial fix · 0.53.0, 1.25.10 +1 CWE-835
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0045 · Published 2025-12-29 · Partial fix · 6.14.1 CWE-20
THREATIST.IORead the docs