Red Hat Openshift Pipelines vulnerabilities

13 CVEs affecting Red Hat Openshift Pipelines, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12143, published 2026-06-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-1394, published 2024-03-21. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in…
CVE-2026-1615, published 2026-02-09. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to…
CVE-2024-11831, published 2025-02-10. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object…
CVE-2026-9277, published 2026-05-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2024-52011, published 2026-06-01. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an…
CVE-2025-8556, published 2025-08-06. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point…
CVE-2025-11065, published 2026-01-26. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error…

Latest

CVE-2026-10840, published 2026-06-04. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources…
CVE-2026-0775, published 2026-01-23. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker…