Vulnerabilities of Red Hat Red Hat OpenShift Dev Spaces

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-5598	Covert timing channel vulnerability in Legion of the Bouncy Castle Inc	8.9 High	Apr 15, 2026
CVE-2026-33806	Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed…	7.5 High	Apr 15, 2026
CVE-2026-5795	In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable	7.4 High	Apr 8, 2026
CVE-2026-32283	If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection…	7.5 High	Apr 8, 2026
CVE-2026-34986	Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including…	7.5 High	Apr 6, 2026
CVE-2026-34601	xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module	7.5 High	Apr 2, 2026
CVE-2026-4800	The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same…	8.1 High	Mar 31, 2026
CVE-2026-33938	Handlebars provides the power necessary to let users build semantic templates	8.1 High	Mar 27, 2026
CVE-2026-33937	Handlebars provides the power necessary to let users build semantic templates	9.8 Critical	Mar 27, 2026
CVE-2026-2229	ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of…	7.5 High	Mar 12, 2026
CVE-2026-1528	ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length	7.5 High	Mar 12, 2026
CVE-2026-1526	The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during…	7.5 High	Mar 12, 2026
CVE-2026-29786	node-tar is a full-featured Tar for Node.js	8.2 High	Mar 7, 2026
CVE-2026-29074	SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files	7.5 High	Mar 6, 2026
CVE-2025-69534	Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser…	7.5 High	Mar 5, 2026
CVE-2025-15558	Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not…	7.0 High	Mar 4, 2026
CVE-2026-27446	Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis	9.3 Critical	Mar 4, 2026
CVE-2026-27959	Koa is middleware for Node.js using ES2017 async functions	7.5 High	Feb 26, 2026
CVE-2025-69873	ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the…	2.9 Low	Feb 11, 2026
CVE-2026-25639	Axios is a promise based HTTP client for the browser and Node.js	7.5 High	Feb 9, 2026
CVE-2025-61726	The net/url package does not set a limit on the number of query parameters in a query	7.5 High	Jan 28, 2026
CVE-2026-24842	node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink…	8.2 High	Jan 28, 2026
CVE-2025-14969	A flaw was found in Hibernate Reactive	4.3 Medium	Jan 26, 2026
CVE-2025-11065	Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure	5.3 Medium	Jan 26, 2026
CVE-2026-0603	Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection	8.3 High	Jan 23, 2026

Other Red Hat products