Red Hat Openshift Data Foundation 4.18 vulnerabilities

4 CVEs affecting Red Hat Openshift Data Foundation 4.18, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12143, published 2026-06-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-35469, published 2026-04-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2025-7195, published 2025-08-07. Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days. Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which…