{
  "affected": [
    {
      "affectedData": [
        {
          "product": "DOMPurify",
          "vendor": "cure53",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.4.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8B46CA2-8534-449B-8178-06632ED40826",
              "versionEndExcluding": "3.4.7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside \u003ctemplate\u003e.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7."
    }
  ],
  "id": "CVE-2026-49978",
  "lastModified": "2026-07-21T19:49:00.217",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49978",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-21T14:59:10.987336Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-14T21:17:02.560",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory",
        "Exploit"
      ],
      "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Vendor Advisory",
        "Exploit"
      ],
      "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.4.6"
      },
      "package": {
        "ecosystem": "npm",
        "name": "dompurify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49978"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-15T20:01:45Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "If the HTML you give it contains a \u003ctemplate\u003e element, and inside that template there\u0027s an element with a shadow DOM attached to it, DOMPurify quietly skips over the shadow contents. Whatever the attacker put in there - an image with an onerror handler, a link with a javascript: URL, even a full script - survives untouched. The moment the application uses that template the way templates are meant to be used (cloning it and inserting the result into the page), the malicious payload comes along and runs as if it had never been sanitized. From there an attacker gets everything XSS normally gets them: session cookies, stored tokens, the ability to act as the user, and the ability to leave persistent payloads behind for the next person who visits.\n\n[advisory.pdf](https://github.com/user-attachments/files/28275600/advisory.pdf)\n\n[poc.html](https://github.com/user-attachments/files/28275708/poc.html)",
  "id": "GHSA-rp9w-3fw7-7cwq",
  "modified": "2026-06-15T20:01:45Z",
  "published": "2026-06-15T20:01:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cure53/DOMPurify"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside \u003ctemplate\u003e.content"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer Hub\nuser experience that simplifies the automation experience for Ansible users of all skill levels.\nThe Ansible plug-ins provide curated content and features to accelerate Ansible learner\nonboarding and streamline Ansible use case adoption across your organization.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:42815",
        "url": "https://access.redhat.com/errata/RHSA-2026:42815"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44289",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44289"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44290",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44290"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44291",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44291"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44292",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44292"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45740",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48801",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59873",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59874",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform",
        "url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42815.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update",
    "tracking": {
      "current_release_date": "2026-08-05T06:40:10+00:00",
      "generator": {
        "date": "2026-08-05T06:40:10+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:42815",
      "initial_release_date": "2026-07-21T14:07:31+00:00",
      "revision_history": [
        {
          "date": "2026-07-21T14:07:31+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-01T08:08:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-05T06:40:10+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Automation Platform 2.2",
                "product": {
                  "name": "Red Hat Ansible Automation Platform 2.2",
                  "product_id": "Red Hat Ansible Automation Platform 2.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_portal:2.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Automation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64",
                  "product_id": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/automation-portal@sha256%3A22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/automation-portal\u0026tag=1784622951"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64 as a component of Red Hat Ansible Automation Platform 2.2",
          "product_id": "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "cve": "CVE-2026-44289",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-05-13T16:05:16.500414+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477130"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a library that compiles protobuf definitions into JavaScript functions. A remote attacker could exploit this vulnerability by sending a specially crafted protobuf binary payload. This payload could cause uncontrolled recursion during the decoding of nested protobuf data, leading to the exhaustion of the JavaScript call stack. This ultimately results in a Denial of Service (DoS) for applications using the affected library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An uncontrolled recursion vulnerability was discovered in protobufjs which can allow a remote attacker to cause a Denial of Service (DoS) via stack exhaustion. Red Hat products bundling vulnerable instances of this npm package (specifically versions prior to 7.5.6 and 8.0.2) are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44289"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477130",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477130"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44289",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44289"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44289",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44289"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-685m-2w69-288q"
        }
      ],
      "release_date": "2026-05-13T14:39:09.791000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Avoid decoding untrusted protobuf binary data with affected versions. If immediate upgrade is not possible, reject excessively nested messages at an outer protocol boundary where feasible, or isolate protobuf decoding in a process that can be safely restarted.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via uncontrolled recursion in protobuf decoding"
    },
    {
      "cve": "CVE-2026-44290",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-05-13T16:03:39.540492+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477100"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs. This vulnerability allows an attacker to craft a protobuf schema or JSON descriptor that, when processed, can traverse through inherited object properties. This can lead to writing to global JavaScript constructors, corrupting process-wide built-in functionality. The most significant impact is a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted schema",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in protobufjs. A remote attacker could provide a specially crafted protobuf schema or JSON descriptor, which, when processed by an application using protobufjs, could corrupt process-wide built-in functionality, leading to a persistent denial of service. This impact is contingent on the application parsing untrusted schemas or descriptors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44290"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477100",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477100"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44290",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44290"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44290",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44290"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg"
        }
      ],
      "release_date": "2026-05-13T14:41:15.312000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, Red Hat recommends configuring applications to avoid parsing or loading protobuf schemas or JSON descriptors from untrusted sources. If processing untrusted schemas is unavoidable, implement strict validation to reject option names containing unsafe property path components before loading them. Additionally, consider running schema processing in an isolated environment to limit the blast radius of potential corruption.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted schema"
    },
    {
      "cve": "CVE-2026-44291",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2026-05-13T16:04:13.828371+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a library that compiles protobuf definitions into JavaScript functions. This prototype pollution vulnerability occurs when `Object.prototype` is polluted, allowing attacker-controlled properties to be resolved as valid protobuf type information. This can lead to attacker-controlled strings being emitted into generated JavaScript code, potentially resulting in arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in protobufjs, a JavaScript library, potentially enables arbitrary code execution when a separate prototype pollution vulnerability is present in an application. Exploitation requires an attacker to first pollute `Object.prototype` and then trigger protobufjs functionality that generates encode or decode code for affected types. Red Hat products utilizing `protobufjs` may be impacted if they are vulnerable to prototype pollution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44291"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44291",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44291"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44291",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44291"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7"
        }
      ],
      "release_date": "2026-05-13T14:42:13.984000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Mitigation involves preventing prototype pollution within applications that utilize protobufjs. Administrators should ensure that untrusted input cannot pollute `Object.prototype` in the application or its dependencies. Additionally, isolating schema and message processing from untrusted application states can prevent attacker-controlled properties from being resolved as valid protobuf type information.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution"
    },
    {
      "cve": "CVE-2026-44292",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-05-13T16:03:03.431568+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477088"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a library that compiles protobuf definitions into JavaScript functions. This vulnerability allows an attacker to manipulate the internal structure of message objects. By providing a specially crafted input, an attacker could alter the prototype of individual message instances, potentially leading to unauthorized modification of data or unexpected application behavior, thereby impacting data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Data integrity impact due to prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability where `protobufjs` can be exploited for prototype pollution on individual message instances. Applications that construct `protobufjs` messages from attacker-controlled plain objects, particularly those parsing untrusted JSON input, are susceptible to data integrity issues through manipulation of the object\u0027s prototype chain. This does not affect global prototypes but can lead to unexpected application behavior.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477088",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477088"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44292"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w"
        }
      ],
      "release_date": "2026-05-13T14:42:55.155000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications should avoid directly passing attacker-controlled plain objects to protobufjs message constructors. If processing untrusted JSON input, it is crucial to validate or sanitize object keys and explicitly reject any `__proto__` properties before constructing protobuf messages. This operational control prevents the manipulation of message instance prototypes.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Data integrity impact due to prototype pollution"
    },
    {
      "cve": "CVE-2026-45740",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-05-13T16:02:41.729478+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in protobufjs, which could allow a remote attacker to exhaust the JavaScript call stack by providing a specially crafted JSON descriptor with deeply nested namespace definitions. This vulnerability impacts Red Hat products that utilize protobufjs for processing protobuf definitions potentially leading to application unresponsiveness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6"
        }
      ],
      "release_date": "2026-05-13T14:46:02.689000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors"
    },
    {
      "cve": "CVE-2026-48801",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T21:02:55.149976+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package\u0027s primary public API, has an algorithmic complexity of O(N\u00b2) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in linkify-it, a link recognition library, can lead to a denial of service in Red Hat products. The vulnerability arises from an O(N\u00b2) algorithmic complexity when processing untrusted Markdown with numerous fuzzy links or emails, potentially causing excessive CPU consumption and worker-process unavailability. This risk is present in services that synchronously render untrusted Markdown with the linkify feature enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159",
          "url": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4",
          "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
        }
      ],
      "release_date": "2026-07-14T20:03:56.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability"
    },
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    },
    {
      "cve": "CVE-2026-59873",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-08T16:01:31.576716+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: node-tar: Denial of Service via crafted gzip bomb",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library\u0027s archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59873",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3",
          "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
        }
      ],
      "release_date": "2026-07-08T15:22:40.077000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "cve": "CVE-2026-59874",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:09.952291+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498116"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: Node-tar: Denial of Service via malformed tar archive header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. This can impact the availability of services relying on node-tar for archive manipulation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498116",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498116"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59874",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59874"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5",
          "url": "https://github.com/isaacs/node-tar/commit/9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-8x88-c5mf-7j5w"
        }
      ],
      "release_date": "2026-07-08T15:23:47.527000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-21T14:07:31+00:00",
          "details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:42815"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:22b248581cace0f76628071e1fcb111e212479e3096fd6a70bac3823c3ce4f0f_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: Node-tar: Denial of Service via malformed tar archive header"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Virtualization release v4.22 is now available with updates to packages and images that fix several bugs and add enhancements.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization v4.22 images.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:43625",
        "url": "https://access.redhat.com/errata/RHSA-2026:43625"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43625.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Virtualization v4.22 Images",
    "tracking": {
      "current_release_date": "2026-08-05T06:40:10+00:00",
      "generator": {
        "date": "2026-08-05T06:40:10+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:43625",
      "initial_release_date": "2026-07-22T15:35:04+00:00",
      "revision_history": [
        {
          "date": "2026-07-22T15:35:04+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-01T08:08:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-05T06:40:10+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Container Native Virtualization 4.22",
                "product": {
                  "name": "Red Hat Container Native Virtualization 4.22",
                  "product_id": "Red Hat Container Native Virtualization 4.22",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:container_native_virtualization:4.22::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Container Native Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ccca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ccca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ccca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3Accca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784634128"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448_arm64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448_arm64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3Affb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448?arch=arm64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784634128"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d_s390x",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d_s390x",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3Ad5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d?arch=s390x\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784634128"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ccca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609_amd64 as a component of Red Hat Container Native Virtualization 4.22",
          "product_id": "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ccca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ccca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d_s390x as a component of Red Hat Container Native Virtualization 4.22",
          "product_id": "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d_s390x"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d_s390x",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.22"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448_arm64 as a component of Red Hat Container Native Virtualization 4.22",
          "product_id": "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448_arm64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448_arm64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.22"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ccca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609_amd64",
          "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d_s390x",
          "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-22T15:35:04+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ccca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609_amd64",
            "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d_s390x",
            "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:43625"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ccca927ed5bc13a73798de941a82cd5f5248f3c7734451f40e0db4a6bfa8e609_amd64",
            "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:d5baeb7beab6cc11096bf75b71d42d1d356f0f2aff6d5eabc41715fd5a15088d_s390x",
            "Red Hat Container Native Virtualization 4.22:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ffb2fba6539cb7454adbe3bd55a3120f2d8d6c74ce39a86da002ac95dc27f448_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Virtualization release v4.14 is now available with updates to packages and images that fix several bugs and add enhancements.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization v4.14 images.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:46539",
        "url": "https://access.redhat.com/errata/RHSA-2026:46539"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46539.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Virtualization v4.14 Images",
    "tracking": {
      "current_release_date": "2026-08-05T06:40:11+00:00",
      "generator": {
        "date": "2026-08-05T06:40:11+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:46539",
      "initial_release_date": "2026-07-27T12:12:13+00:00",
      "revision_history": [
        {
          "date": "2026-07-27T12:12:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-01T08:08:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-05T06:40:11+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Container Native Virtualization 4.14",
                "product": {
                  "name": "Red Hat Container Native Virtualization 4.14",
                  "product_id": "Red Hat Container Native Virtualization 4.14",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:container_native_virtualization:4.14::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Container Native Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3A16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784741686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267_arm64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267_arm64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3Aea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267?arch=arm64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784741686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c_amd64 as a component of Red Hat Container Native Virtualization 4.14",
          "product_id": "Red Hat Container Native Virtualization 4.14:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267_arm64 as a component of Red Hat Container Native Virtualization 4.14",
          "product_id": "Red Hat Container Native Virtualization 4.14:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267_arm64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267_arm64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.14"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Container Native Virtualization 4.14:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c_amd64",
          "Red Hat Container Native Virtualization 4.14:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T12:12:13+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.14:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c_amd64",
            "Red Hat Container Native Virtualization 4.14:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46539"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Container Native Virtualization 4.14:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:16c7c089b09d001af38a432feb6ced7a2b6a3ae37272a8d9bb9e4bfc8c76ef3c_amd64",
            "Red Hat Container Native Virtualization 4.14:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:ea4890f4be1cbf6fd418e9fcb1d7d4a9c8501d59d015c0d053a957a6d58eb267_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Virtualization release v4.17 is now available with updates to packages and images that fix several bugs and add enhancements.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization v4.17 images.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:46558",
        "url": "https://access.redhat.com/errata/RHSA-2026:46558"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46558.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Virtualization v4.17 Images",
    "tracking": {
      "current_release_date": "2026-08-05T07:20:22+00:00",
      "generator": {
        "date": "2026-08-05T07:20:22+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:46558",
      "initial_release_date": "2026-07-27T12:14:45+00:00",
      "revision_history": [
        {
          "date": "2026-07-27T12:14:45+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-01T08:08:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-05T07:20:22+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Container Native Virtualization 4.17",
                "product": {
                  "name": "Red Hat Container Native Virtualization 4.17",
                  "product_id": "Red Hat Container Native Virtualization 4.17",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:container_native_virtualization:4.17::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Container Native Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3A631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784805322"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:fd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf_arm64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:fd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf_arm64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:fd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin-rhel9@sha256%3Afd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf?arch=arm64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9\u0026tag=1784805322"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf_amd64 as a component of Red Hat Container Native Virtualization 4.17",
          "product_id": "Red Hat Container Native Virtualization 4.17:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:fd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf_arm64 as a component of Red Hat Container Native Virtualization 4.17",
          "product_id": "Red Hat Container Native Virtualization 4.17:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:fd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf_arm64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:fd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf_arm64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.17"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Container Native Virtualization 4.17:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf_amd64",
          "Red Hat Container Native Virtualization 4.17:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:fd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T12:14:45+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.17:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf_amd64",
            "Red Hat Container Native Virtualization 4.17:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:fd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46558"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Container Native Virtualization 4.17:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:631740800726708bb355e725d2b8c8837011c9169cccf38ed49e21f00370eeaf_amd64",
            "Red Hat Container Native Virtualization 4.17:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9@sha256:fd8ac98be5903b4801fff71ecc6bfbc3d0aaa9e7ce19e280919d2eb14f0236bf_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Virtualization release v4.12 is now available with updates to packages and images that fix several bugs and add enhancements.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains OpenShift Virtualization v4.12 images.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:46623",
        "url": "https://access.redhat.com/errata/RHSA-2026:46623"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46623.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Virtualization v4.12 Images",
    "tracking": {
      "current_release_date": "2026-08-05T06:40:12+00:00",
      "generator": {
        "date": "2026-08-05T06:40:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:46623",
      "initial_release_date": "2026-07-27T12:25:49+00:00",
      "revision_history": [
        {
          "date": "2026-07-27T12:25:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-01T08:08:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-05T06:40:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Container Native Virtualization 4.12",
                "product": {
                  "name": "Red Hat Container Native Virtualization 4.12",
                  "product_id": "Red Hat Container Native Virtualization 4.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:container_native_virtualization:4.12::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Container Native Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64",
                "product": {
                  "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64",
                  "product_id": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kubevirt-console-plugin@sha256%3A91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-console-plugin\u0026tag=1784710594"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64 as a component of Red Hat Container Native Virtualization 4.12",
          "product_id": "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64"
        },
        "product_reference": "registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64",
        "relates_to_product_reference": "Red Hat Container Native Virtualization 4.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T12:25:49+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46623"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T12:25:49+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46623"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Container Native Virtualization 4.12:registry.redhat.io/container-native-virtualization/kubevirt-console-plugin@sha256:91f0b7aa48e6d376398742fd6517a23fa9b07c5947493457ec9dd49a9609ae50_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Developer Hub (RHDH) is extensible by the plugins included herein.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:48126",
        "url": "https://access.redhat.com/errata/RHSA-2026:48126"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45740",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-46625",
        "url": "https://access.redhat.com/security/cve/CVE-2026-46625"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48068",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48068"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48069",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48069"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48801",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-49978",
        "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-5038",
        "url": "https://access.redhat.com/security/cve/CVE-2026-5038"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-5079",
        "url": "https://access.redhat.com/security/cve/CVE-2026-5079"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59877",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh",
        "url": "https://catalog.redhat.com/search?gs\u0026searchType=containers\u0026q=rhdh"
      },
      {
        "category": "external",
        "summary": "https://developers.redhat.com/rhdh/overview",
        "url": "https://developers.redhat.com/rhdh/overview"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_developer_hub",
        "url": "https://docs.redhat.com/en/documentation/red_hat_developer_hub"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15065",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15065"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15162",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15162"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15197",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15197"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15243",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15243"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15469",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15469"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15535",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15535"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15582",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15582"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15681",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15681"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15778",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15778"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15779",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15779"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15786",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15786"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15787",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15787"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/RHIDP-15801",
        "url": "https://redhat.atlassian.net/browse/RHIDP-15801"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48126.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.",
    "tracking": {
      "current_release_date": "2026-08-05T09:09:31+00:00",
      "generator": {
        "date": "2026-08-05T09:09:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:48126",
      "initial_release_date": "2026-07-29T18:49:37+00:00",
      "revision_history": [
        {
          "date": "2026-07-29T18:49:37+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-01T08:08:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-05T09:09:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Developer Hub 1.10",
                "product": {
                  "name": "Red Hat Developer Hub 1.10",
                  "product_id": "Red Hat Developer Hub 1.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhdh:1.10::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Developer Hub"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-lightspeed@sha256%3Ab3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed\u0026tag=1785333413"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256%3A7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend\u0026tag=1785332487"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator@sha256%3A1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator\u0026tag=1785340831"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256%3Af4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend\u0026tag=1785332825"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256%3A9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki\u0026tag=1785332668"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256%3A2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets\u0026tag=1785332928"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64",
                "product": {
                  "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64",
                  "product_id": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256%3Aecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93?arch=amd64\u0026repository_url=registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator\u0026tag=1785332694"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64 as a component of Red Hat Developer Hub 1.10",
          "product_id": "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        },
        "product_reference": "registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64",
        "relates_to_product_reference": "Red Hat Developer Hub 1.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-5038",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-06-15T16:01:19.525752+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488935"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in multer. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by initiating and then aborting or sending malformed multipart uploads. This action leaves orphaned partial files on the disk, which can lead to the exhaustion of available disk space without requiring any specific application bug.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multer: Multer: Denial of Service via aborted or malformed multipart uploads",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5038"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488935",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488935"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5038",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5038"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5038",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5038"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm",
          "url": "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm"
        }
      ],
      "release_date": "2026-06-15T14:23:24.230000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multer: Multer: Denial of Service via aborted or malformed multipart uploads"
    },
    {
      "cve": "CVE-2026-5079",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-06-15T15:02:06.834404+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488927"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The vulnerability ultimately leads to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multer: Multer: Denial of Service via deeply nested field names in multipart form data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5079"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488927",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488927"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5079",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5079"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5079",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5079"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j",
          "url": "https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j"
        }
      ],
      "release_date": "2026-06-15T13:56:45.520000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multer: Multer: Denial of Service via deeply nested field names in multipart form data"
    },
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-13676",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-06-29T14:01:55.592330+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494197"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494197",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
          "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
        }
      ],
      "release_date": "2026-06-29T13:22:44.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
    },
    {
      "cve": "CVE-2026-45740",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-05-13T16:02:41.729478+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in protobufjs, which could allow a remote attacker to exhaust the JavaScript call stack by providing a specially crafted JSON descriptor with deeply nested namespace definitions. This vulnerability impacts Red Hat products that utilize protobufjs for processing protobuf definitions potentially leading to application unresponsiveness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6"
        }
      ],
      "release_date": "2026-05-13T14:46:02.689000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors"
    },
    {
      "cve": "CVE-2026-46625",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-06-10T22:01:17.685570+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487740"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in JavaScript Cookie (js-cookie). This vulnerability allows a remote attacker to manipulate cookie attributes by exploiting a prototype pollution issue within the `assign()` helper function. When processing specially crafted JSON input, the flaw enables an attacker to hijack the prototype of a cookie\u0027s attribute object. This allows the attacker to set sensitive cookie attributes such as `domain`, `secure`, `samesite`, `expires`, and `path`, potentially leading to security bypasses or session manipulation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46625"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487740",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487740"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46625",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46625"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46625",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46625"
        },
        {
          "category": "external",
          "summary": "https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020",
          "url": "https://github.com/js-cookie/js-cookie/commit/eb3c40e89731e99b8970faaf35ddad249c6c0020"
        },
        {
          "category": "external",
          "summary": "https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7",
          "url": "https://github.com/js-cookie/js-cookie/releases/tag/v3.0.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j",
          "url": "https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j"
        }
      ],
      "release_date": "2026-06-10T21:18:05.372000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution"
    },
    {
      "cve": "CVE-2026-48068",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-06-11T13:27:54+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499682"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed HTTP/2 stream to a gRPC server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in @grpc/grpc-js. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. There is no workaround.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499682",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499682"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48068",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2",
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2"
        }
      ],
      "release_date": "2026-06-11T13:27:54+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation"
    },
    {
      "cve": "CVE-2026-48069",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-06-11T13:27:44+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499683"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming compressed message can cause a client or server process to crash. This vulnerability affects all clients and servers that use @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed compressed message over a gRPC connection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in @grpc/grpc-js. An invalid incoming compressed message can cause a client or server process to crash. This affects all clients and servers that use @grpc/grpc-js. There is no workaround.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48069"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499683",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499683"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48069",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48069"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48069",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48069"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq",
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-99f4-grh7-6pcq"
        }
      ],
      "release_date": "2026-06-11T13:27:44+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grpc-js: @grpc/grpc-js: Client or server crash via malformed compressed message"
    },
    {
      "cve": "CVE-2026-48801",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T21:02:55.149976+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package\u0027s primary public API, has an algorithmic complexity of O(N\u00b2) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in linkify-it, a link recognition library, can lead to a denial of service in Red Hat products. The vulnerability arises from an O(N\u00b2) algorithmic complexity when processing untrusted Markdown with numerous fuzzy links or emails, potentially causing excessive CPU consumption and worker-process unavailability. This risk is present in services that synchronously render untrusted Markdown with the linkify feature enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159",
          "url": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4",
          "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
        }
      ],
      "release_date": "2026-07-14T20:03:56.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability"
    },
    {
      "cve": "CVE-2026-49978",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-14T21:05:26.253019+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500695"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a \u003ctemplate\u003e.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `\u003ctemplate\u003e.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500695",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500695"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-49978",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49978"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff",
          "url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7",
          "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq"
        }
      ],
      "release_date": "2026-07-14T20:02:46.263000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    },
    {
      "cve": "CVE-2026-59877",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-08T16:01:54.459482+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498127"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library\u0027s parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. A remote attacker can exploit this by providing a malformed schema, causing an infinite loop during parsing and leading to service unavailability. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
        ],
        "known_not_affected": [
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
          "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498127",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498127"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59877",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217",
          "url": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f",
          "url": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/pull/2352",
          "url": "https://github.com/protobufjs/protobuf.js/pull/2352"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww"
        }
      ],
      "release_date": "2026-07-08T15:28:07.696000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T18:49:37+00:00",
          "details": "For more about Red Hat Developer Hub, see References links",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:48126"
        },
        {
          "category": "workaround",
          "details": "Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.",
          "product_ids": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend@sha256:7c8d1febdfe711efb09ba9ad3637c1fdfa13a7ee1f7d8cdeac837ed67bcef0de_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed@sha256:b3d6129d2600c3b0f1dd8b263168fd54207a76d88ca69f6888f41d6064fb866d_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki@sha256:9ff9a24a518e74d097f6b842ba30b1456feaf69092fe9cdee969e4f4b9c9663e_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend@sha256:f4d83d57c652ebb5e3b9ba672ac40393953ebc49a7313f9ae2a0774c9345f4d9_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets@sha256:2ae7ab8278dbde74019aa7eece446b42e3799595fbe982d3fed74061fef2d832_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator@sha256:1d1870286066c57428f771272e0a73d0418bc36b9fd24d79e07c66afa4bc0708_amd64",
            "Red Hat Developer Hub 1.10:registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator@sha256:ecf4b15f6c848149e04c972ae95599762339d7765918dc98435bddd8f03d7b93_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted .proto schema"
    }
  ]
}