Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 72
A flaw was found in Nodemailer.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00599 · Published 2025-12-18 · Partial fix · 7.0.11 CWE-703
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.7· Network · No auth · No interaction · EPSS 0.00854 · Published 2026-06-11 · Partial fix · 1.15.2, 0.31.1 CWE-1321
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-03-06 · Partial fix · 3.8.3, 4.3.7 +2 CWE-1321
Priority MEDIUM 40
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03963 · Published 2022-03-18 · Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327
Priority LOW 37
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM).
CVSS 3.1HIGH 8.2· Local · High privileges · No interaction · EPSS 0.00151 · Published 2026-04-07 · Partial fix · 1776881164, 1777478390 +4 CWE-295
Priority LOW 36
RHACM: unauthenticated SSRF in console API endpoint.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00236 · Published 2023-01-11 · Partial fix CWE-918
Priority LOW 35
The grc-policy-propagator allows security escalation within the cluster.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00198 · Published 2023-06-05 · No fix listed CWE-269
Priority LOW 34
A flaw was found in insights-client.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00501 · Published 2026-08-11 · Fixed in 1787688993, 1787259125 +4 CWE-532
Priority LOW 33
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00479 · Published 2023-10-05 · No fix listed CWE-863
Priority LOW 31
A flaw was found in insights-client.
CVSS 3.1MEDIUM 6.8· Network · High privileges · No interaction · EPSS 0.00694 · Published 2026-08-11 · Fixed in 1787259125, 1786882244 +3 CWE-22
Priority LOW 31
A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00937 · Published 2022-09-01 · Partial fix CWE-89
Priority LOW 30
A flaw was found in insights-client.
CVSS 3.1HIGH 7.1· Local · No auth · No interaction · EPSS 0.00156 · Published 2026-08-11 · Fixed in 1787688993, 1787259125 +4 CWE-532
Priority LOW 30
A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00117 · Published 2026-04-08 · No fix listed CWE-276
Priority LOW 30
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00609 · Published 2020-11-09 · Fixed CWE-863
Priority LOW 28
A flaw was found in insights-client.
CVSS 3.1MEDIUM 6.5· Local · Low privileges · No interaction · EPSS 0.0016 · Published 2026-08-12 · Fixed in 1787688993, 1787259125 +4 CWE-250
Priority LOW 24
A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00167 · Published 2025-07-02 · Fixed in 0.16.0, v2.11.8-3 +14 CWE-359
Priority LOW 16
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0.
CVSS 3.1LOW 3.5· Adjacent network · Low privileges · No interaction · EPSS 0.00251 · Published 2020-11-23 · Partial fix CWE-321
THREATIST.IORead the docs