Read the docs
Red Hat Security Advisory

RHSA-2026:86675

Ansible plug-ins for Red Hat Developer Hub Product Release Update

Released 2026-10-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 10 records

TI-2026-62618 CVE-2026-92955 · GHSA-88hf-g992-jg85 · GHSA-gg6f-mhqm-f7gp

vm2 before 3.11.8 Sandbox Escape via NodeVM

Priority HIGH 82

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00712 Published 2026-09-17 Fixed in 3.11.8 CWE-913
TI-2026-63115 CVE-2026-93749 · GHSA-68fv-2mgg-jv7q

source-map-js through 1.2.1 Event Loop Denial of Service

Priority MEDIUM 44

source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00455 Published 2026-09-18 Partial fix · 1.2.2 CWE-1284
TI-2026-69075 CVE-2026-106501 · GHSA-g2v8-7jhw-pp8p

Sensitive information exposure in Backstage Scaffolder

Priority MEDIUM 43

Backstage is an open framework for building developer portals.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00484 Published 2026-10-06 Partial fix · 1.49.6, 1.50.5 +5 CWE-200
TI-2026-61668 CVE-2026-90711 · GHSA-jqcg-44mw-7w3h

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Priority MEDIUM 41

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0026 Published 2026-09-15 Partial fix · 2.0.8 CWE-290