Red Hat Build Of Podman Desktop vulnerabilities

9 CVEs affecting Red Hat Build Of Podman Desktop, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-107935, published 2026-10-09.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-41673, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior,…
• CVE-2026-9277, published 2026-05-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which…
• CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
• CVE-2026-41674, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior,…
• CVE-2026-41672, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior,…
• CVE-2026-41675, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior,…
• CVE-2026-34601, published 2026-04-02. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9,…
• CVE-2024-52011, published 2026-06-01. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an…
• CVE-2026-107935, published 2026-10-09. Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days. A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the…