Vulnerabilities of Red Hat Red Hat 3scale API Management Platform 2

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2025-61726	The net/url package does not set a limit on the number of query parameters in a query	7.5 High	Jan 28, 2026
CVE-2026-24842	node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink…	8.2 High	Jan 28, 2026
CVE-2026-0775	npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability	7.0 High	Jan 23, 2026
CVE-2025-13465	The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution	6.9 Medium	Jan 21, 2026
CVE-2026-23950	node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3	8.8 High	Jan 20, 2026
CVE-2026-23745	node-tar is a Tar for Node.js	8.2 High	Jan 16, 2026
CVE-2024-12125	3scale-porta: readonly fields not validated server-side	7.5 High	Nov 6, 2025
CVE-2025-49794	Libxml: heap use after free (uaf) leads to denial of service (dos)	9.1 Critical	Jun 16, 2025
CVE-2024-11831	Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript	5.4 Medium	Feb 10, 2025
CVE-2024-10295	Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a request	7.5 High	Oct 24, 2024
CVE-2024-9671	System: pdf invoices of the developer users can be seen if the url is known	5.3 Medium	Oct 9, 2024
CVE-2024-0560	Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions	6.3 Medium	Feb 28, 2024
CVE-2023-4910	A flaw was found In 3Scale Admin Portal	5.5 Medium	Nov 6, 2023
CVE-2023-5349	A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick	5.3 Medium	Oct 30, 2023
CVE-2023-0456	A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token…	7.4 High	Sep 27, 2023

Other Red Hat products