Threats Tagged 'cve-2026-87776'

A security vulnerability (CVE-2026-49825) affecting the lxml HTML cleaner component used in Python environments has been identified and addressed by Red Hat. The issue involves a URL bypass vulnerability in the Cleaner due to a missing xlink:href attribute. This vulnerability affects multiple specific versions of Red Hat Quay and related Python lxml packages. Red Hat has issued an important security advisory with updated packages to remediate this issue.

Red Hat issued a security advisory for Multicluster Global Hub 1.8.2 addressing a high severity vulnerability identified as CVE-2026-17106. The vulnerability affects the component that manages multiple hub clusters from a single hub cluster. The advisory also includes updates to Red Hat Hardened Images RPMs, specifically podman packages. A fix is available in updated packages including podman-6.0.2-2.2.hum1. No CVSS score is provided. The advisory provides instructions for applying the update.

Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer Hub user experience that simplifies the automation experience for Ansible users of all skill levels. The Ansible plug-ins provide curated content and features to accelerate Ansible learner onboarding and streamline Ansible use case adoption across your organization.

Red Hat has released a new container image for the satellite/iop-host-inventory-frontend-rhel9 component used in Red Hat Satellite. This component is part of Red Hat Lightspeed in Satellite, which analyzes system health and configuration locally without sending data to Red Hat services. Multiple CVEs including CVE-2026-59879 are associated with this advisory. A patch is available for affected versions, and users are advised to update accordingly.

Red Hat Developer Hub (RHDH) versions prior to 1.9.9 contain a security vulnerability identified as CVE-2026-19534. This vulnerability affects the enterprise-grade, self-managed developer portal based on Backstage.io, supported on Kubernetes platforms including OpenShift. Red Hat has released version 1.9.9 which addresses this and other issues. No CVSS score is provided for this vulnerability, but it is classified as high severity by the source.

The Node.js compression middleware (compression) versions before 1.8.2 have a vulnerability where aborted client connections during compressed responses cause native zlib memory leaks. This can be exploited by a remote unauthenticated attacker to exhaust server memory and cause a crash. The issue is fixed in version 1.8.2, and users should upgrade to this or later versions.