Red Hat Openshift Service Mesh 3 vulnerabilities

10 CVEs affecting Red Hat Openshift Service Mesh 3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92982, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-9277, published 2026-05-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2024-52011, published 2026-06-01. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an…
CVE-2025-8556, published 2025-08-06. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point…
CVE-2026-89091, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation…
CVE-2026-92982, published 2026-10-15. High severity, CVSS 8.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values.…
CVE-2025-11060, published 2025-09-26. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing…
CVE-2026-11332, published 2026-06-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument…