Red Hat Red Hat OpenShift Dev Spaces

• CVE-2026-107912 High 7.7 Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw 0.2%
• CVE-2026-107935 Critical 9.3 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose 0.2%
• CVE-2026-91142 Low 3.6 Cockpit: cockpit: unauthorized modification of login records via integer overflow 0.1%
• CVE-2026-91147 Medium 5.9 Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash 0.6%
• CVE-2026-91149 High 7.5 Cockpit: cockpit: denial of service via unbounded connection thread spawning 0.6%
• CVE-2025-11395 Medium 5.5 Podman: arbitrary file write when importing oci archive 0.4%
• CVE-2026-79699 Medium 4.4 Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory 0.2%
• CVE-2026-79705 Medium 4.5 Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers 0.4%
• CVE-2026-76235 High 7.5 Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html 0.6%
• CVE-2026-19730 Medium 4.2 Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives 0.1%
• CVE-2025-14969 Medium 4.3 Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect 0.4%
• CVE-2025-11065 Medium 5.3 Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure 0.5%
• CVE-2026-0603 High 8.3 Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection 1.0%
• CVE-2025-57850 Medium 6.4 Codeready-ws: privilege escalation via excessive /etc/passwd permissions 0.2%