Red Hat Developer Hub 1.8 vulnerabilities

3 CVEs affecting Red Hat Developer Hub 1.8, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41674, published 2026-05-07.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-41674, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior,…
• CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
• CVE-2026-24046, published 2026-01-21. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with…