Red Hat Advanced Cluster Security 4 vulnerabilities

12 CVEs affecting Red Hat Advanced Cluster Security 4, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19519, published 2026-08-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-11831, published 2025-02-10. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object…
CVE-2026-35469, published 2026-04-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2026-9165, published 2026-07-06. High severity, CVSS 7.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2025-8556, published 2025-08-06. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point…
CVE-2025-11065, published 2026-01-26. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error…
CVE-2026-19519, published 2026-08-11. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the…
CVE-2026-16254, published 2026-07-20. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in claircore's apk package scanner. Malformed package-database data in a container layer can cause an out-of-bounds access that panics the scanner. If that panic is not recovered,…
CVE-2026-19278, published 2026-08-10. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for…

Latest

CVE-2026-10079, published 2026-07-31. High severity, CVSS 8.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the…
CVE-2025-7195, published 2025-08-07. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which…