Red Hat Developer Hub vulnerabilities

3 CVEs affecting Red Hat Developer Hub, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-44495, published 2026-06-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-44495, published 2026-06-11. High severity, CVSS 7.7. EPSS: 1% chance of exploitation in the next 30 days. Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another…
CVE-2026-3118, published 2026-02-25. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user…
CVE-2025-14874, published 2025-12-18. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.