Red Hat Red Hat 3scale API Management Platform 2

• CVE-2026-92925 High 7.1 Redis: redis: out-of-bounds read via crafted cluster bus packets 0.7%
• CVE-2024-12125 High 7.5 3scale-porta: readonly fields not validated server-side 0.3%
• CVE-2025-49794 Critical 9.1 Libxml: heap use after free (uaf) leads to denial of service (dos) 0.8%
• CVE-2024-11831 Medium 5.4 Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript 1.1%
• CVE-2024-10295 High 7.5 Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a request 0.4%
• CVE-2024-9671 Medium 5.3 System: pdf invoices of the developer users can be seen if the url is known 0.3%
• CVE-2024-0560 Medium 6.3 Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions 0.5%
• CVE-2023-4910 Medium 5.5 3scale-admin-portal: logged out users tokens can be accessed 0.2%
• CVE-2023-5349 Medium 5.3 Draw while calling getdrawinfo() 0.7%
• CVE-2023-0456 High 7.4 Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check 0.6%