Redhat Openshift_container_platform_for_ibm_z

10 CVEs affecting Redhat Openshift_container_platform_for_ibm_z. Latest disclosed: 2025-11-26. Critical: 0, High: 6.

Top CVEs affecting Redhat Openshift_container_platform_for_ibm_z
CVESeverityScorePublishedSummary
CVE-2024-1132High8.12024-04-17A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious requ…
CVE-2022-4039High8.02023-09-22A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allow…
CVE-2025-13601High7.72025-11-26A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to…
CVE-2025-6021High7.52025-06-12A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue…
CVE-2020-8945High7.52020-02-12The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This le…
CVE-2023-6291High7.12024-01-26A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may…
CVE-2024-9676Medium6.52024-10-15A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI…
CVE-2024-1725Medium6.52024-03-07A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to ga…
CVE-2024-8883Medium6.12024-09-19A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http…
CVE-2023-2585Low3.52023-12-21Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof…