Red Hat Multicluster Global Hub vulnerabilities

4 CVEs affecting Red Hat Multicluster Global Hub, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-83550, published 2026-10-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-10894, published 2025-09-24. Critical severity, CVSS 9.6. EPSS: 0.6% chance of exploitation in the next 30 days. Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected…
CVE-2025-8556, published 2025-08-06. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point…
CVE-2025-7195, published 2025-08-07. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which…
CVE-2026-83550, published 2026-10-06. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network…