Known vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-0775	npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability	7.0 High	Jan 23, 2026
CVE-2025-13465	The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution	6.9 Medium	Jan 21, 2026
CVE-2026-23950	node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3	8.8 High	Jan 20, 2026
CVE-2026-23745	node-tar is a Tar for Node.js	8.2 High	Jan 16, 2026
CVE-2026-22029	React Router is a router for React	8.0 High	Jan 10, 2026
CVE-2025-61686	React Router is a router for React	9.1 Critical	Jan 10, 2026
CVE-2026-21441	urllib3 is an HTTP client library for Python	8.9 High	Jan 7, 2026
CVE-2025-14874	A flaw was found in Nodemailer	7.5 High	Dec 18, 2025
CVE-2025-13033	A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient…	7.5 High	Nov 14, 2025
CVE-2025-10894	Malicious code was inserted into the Nx (build system) package and several related plugins	9.6 Critical	Sep 24, 2025
CVE-2025-7195	Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used…	6.4 Medium	Aug 7, 2025
CVE-2025-8556	Github.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect results	3.7 Low	Aug 6, 2025
CVE-2025-6017	A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and…	5.5 Medium	Jul 2, 2025
CVE-2025-2241	A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM)	8.2 High	Mar 17, 2025
CVE-2024-11831	Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript	5.4 Medium	Feb 10, 2025
CVE-2024-9779	A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the…	7.5 High	Dec 17, 2024
CVE-2024-5042	A flaw was found in the Submariner project	6.6 Medium	May 17, 2024
CVE-2024-3727	Containers/image: digest type does not guarantee valid type	8.3 High	May 9, 2024
CVE-2024-1139	Cluster-monitoring-operator: credentials leak	7.7 High	Apr 25, 2024
CVE-2024-0874	A flaw was found in coredns	5.3 Medium	Apr 25, 2024
CVE-2022-3248	A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions	4.4 Medium	Oct 5, 2023
CVE-2023-3089	A compliance problem was found in the Red Hat OpenShift Container Platform	7.0 High	Jul 5, 2023

Other Red Hat products