Red Hat Red Hat Openshift Dev Spaces
17 CVEs affecting Red Hat Red Hat Openshift Dev Spaces. Latest disclosed: 2026-09-18. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12856 | High | 8.8 | 2026-06-29 | A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown conte… |
CVE-2026-0603 | High | 8.3 | 2026-01-23 | A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, u… |
CVE-2024-3727 | High | 8.3 | 2024-05-14 | A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a vi… |
CVE-2026-91149 | High | 7.5 | 2026-09-18 | A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections t… |
CVE-2026-87743 | High | 7.5 | 2026-09-18 | A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and H… |
CVE-2024-1394 | High | 7.5 | 2024-03-21 | A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled… |
CVE-2024-9355 | Medium | 6.5 | 2024-10-01 | A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buf… |
CVE-2025-57850 | Medium | 6.4 | 2025-12-02 | A container privilege escalation flaw was found in certain CodeReady Workspaces images. This issue stems from the /etc/passwd file being created with group-wri… |
CVE-2026-91147 | Medium | 5.9 | 2026-09-18 | A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafte… |
CVE-2025-11395 | Medium | 5.5 | 2026-09-15 | A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the priv… |
CVE-2024-11831 | Medium | 5.4 | 2025-02-10 | A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such… |
CVE-2025-11065 | Medium | 5.3 | 2026-01-26 | A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information… |
CVE-2026-79705 | Medium | 4.5 | 2026-09-15 | A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can e… |
CVE-2026-79699 | Medium | 4.4 | 2026-09-15 | A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction de… |
CVE-2025-14969 | Medium | 4.3 | 2026-01-26 | A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connect… |
CVE-2026-19730 | Medium | 4.2 | 2026-08-13 | The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy atte… |
CVE-2026-91142 | Low | 3.6 | 2026-09-18 | A flaw was found in Cockpit. An integer overflow vulnerability in the `do_lastlog()` function, specifically in the offset calculation for `lastlog` entries on… |