IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API

Vulnerabilidades de openshift pipelines (CVE)

Registros CVE publicados para openshift pipelines, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

1.20 71.21 51.15 21.14 11.16 11.17 11.18 11.19 1
11 resultados
7.5Alta
CVE-2026-40938

Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

tektoncd pipeline; Red Hat Red Hat OpenShift Builds 1.7.3; Red Hat Red Hat OpenShift Builds 1.8.1; Red Hat Red Hat OpenShift Pipelines 1.21

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argumen…

9.8Crítica
CVE-2026-33816

CVE-2026-33816 in github.com/jackc/pgx

github.com/jackc/pgx/v5 github.com/jackc/pgx/v5/pgproto3; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat RHEM 1.0 for RHEL 9

Memory-safety vulnerability in github.com/jackc/pgx/v5.

7.5Alta
CVE-2026-34986

Go JOSE affect by a panic in JWE decryption

go-jose go-jose; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

9.6Crítica
CVE-2026-33211

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

tektoncd pipeline; Red Hat Builds for Red Hat OpenShift 1.6.0; Red Hat Red Hat OpenShift Builds 1.7.3; Red Hat Red Hat OpenShift Pipelines 1.2

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathI…

7.5Alta
CVE-2026-2229

undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation

undici undici; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises sup…

1.0%EPSS
7.5Alta
CVE-2026-1528

undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client

undici undici; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process. Patches Patched i…

7.5Alta
CVE-2026-1526

undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression

undici undici; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compres…

1.3%EPSS
8.7Alta
CVE-2026-29063

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

immutable-js immutable-js; Red Hat Cluster Observability Operator 1.5.0; Red Hat Migration Toolkit for Virtualization 2.1; Red Hat Migration Toolkit for Virtualization 2.9

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been pa…

7.5Alta
CVE-2026-25639

Axios affected by Denial of Service via __proto__ Key in mergeConfig

axios axios; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.6

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can tr…

2.8%EPSS
6.9Media
CVE-2025-13465

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Lodash lodash; Lodash lodash-amd; Lodash lodash-es; Lodash lodash.unset

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…

1.8%EPSS
5.4Media
CVE-2024-11831

Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

serialize-javascript; Red Hat Red Hat Advanced Cluster Security 4.4; Red Hat Red Hat Advanced Cluster Security 4.5; Red Hat Red Hat Ceph Storage 7.1

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code …

1.1%EPSS