Red Hat Cryostat 4 vulnerabilities

13 CVEs affecting Red Hat Cryostat 4, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-10832, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-44724, published 2026-05-27. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active…
CVE-2026-5598, published 2026-04-15. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue…
CVE-2026-9277, published 2026-05-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which…
CVE-2026-5588, published 2026-04-15. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules), Legion of the Bouncy Castle Inc. BCPKIX-FIPS bcpkix on All…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2026-0636, published 2026-04-15. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is…
CVE-2024-52011, published 2026-06-01. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an…
CVE-2026-10832, published 2026-09-18. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding…

Latest

CVE-2025-14813, published 2026-04-15. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files…