Vulnerabilities of Red Hat Red Hat Ansible Automation Platform 2

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-19730	Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives	4.2 Medium	Aug 13, 2026
CVE-2026-18141	A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA)	8.2 High	Jul 31, 2026
CVE-2026-12383	A flaw was found in the Event-Driven Ansible (EDA) server	7.5 High	Jul 27, 2026
CVE-2026-44191	A flaw was found in the Visual Studio Code Ansible Lightspeed extension	7.8 High	Jul 22, 2026
CVE-2026-44187	A flaw was found in the Ansible Lightspeed extension for Visual Studio Code	3.3 Low	Jul 22, 2026
CVE-2026-44192	A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server	6.6 Medium	Jul 22, 2026
CVE-2026-44190	A flaw was found in the Ansible Lightspeed Visual Studio Code extension	7.8 High	Jul 22, 2026
CVE-2026-44189	A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider	7.8 High	Jul 22, 2026
CVE-2026-16544	A flaw was found in AWX	6.5 Medium	Jul 22, 2026
CVE-2026-16493	Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)	7.8 High	Jul 21, 2026
CVE-2026-12701	A path traversal vulnerability was found in pulpcore	9.0 Critical	Jul 20, 2026
CVE-2026-12382	A flaw was found in the AAP Gateway Envoy proxy configuration	8.2 High	Jul 15, 2026
CVE-2026-13676	fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs	7.5 High	Jun 29, 2026
CVE-2026-54513	jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor	8.1 High	Jun 23, 2026
CVE-2026-11807	Eda-server: websocket missing authorization allows credential theft via activation_id spoofing	9.6 Critical	Jun 23, 2026
CVE-2026-48746	vLLM is an inference and serving engine for large language models (LLMs)	9.1 Critical	Jun 22, 2026
CVE-2026-49468	LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format	9.5 Critical	Jun 22, 2026
CVE-2026-54293	NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research…	7.5 High	Jun 22, 2026
CVE-2026-12773	A weakness has been identified in BerriAI litellm up to 1.59.8	6.9 Medium	Jun 21, 2026
CVE-2026-12726	Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential	6.3 Medium	Jun 19, 2026
CVE-2026-48818	Starlette is a lightweight ASGI framework/toolkit	7.5 High	Jun 17, 2026
CVE-2026-48779	ws is an open source WebSocket client and server for Node.js	7.5 High	Jun 16, 2026
CVE-2026-12398	Galaxy_ng: shell injection in legacy role import via unsanitized git ref names	7.5 High	Jun 16, 2026
CVE-2026-44188	Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration	5.3 Medium	Jun 15, 2026
CVE-2026-12143	form-data is a library for creating readable multipart/form-data streams	8.7 High	Jun 12, 2026

Other Red Hat products