Red Hat Trusted Artifact Signer vulnerabilities

9 CVEs affecting Red Hat Trusted Artifact Signer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12143, published 2026-06-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-4432, published 2025-05-09. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to induce this panic by sending a specially…
CVE-2026-9277, published 2026-05-22. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2025-4574, published 2025-05-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.
CVE-2026-4660, published 2026-04-09. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is…
CVE-2025-3416, published 2025-04-08. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect…
CVE-2025-8556, published 2025-08-06. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order point injection and incorrect point…
CVE-2025-11065, published 2026-01-26. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error…
CVE-2026-0775, published 2026-01-23. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker…