Red Hat Self-Service Automation Portal 2 vulnerabilities

9 CVEs affecting Red Hat Self-Service Automation Portal 2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-89091, published 2026-10-08.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-1615, published 2026-02-09. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to…
• CVE-2026-41673, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior,…
• CVE-2026-41674, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior,…
• CVE-2026-41672, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior,…
• CVE-2026-41675, published 2026-05-07. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior,…
• CVE-2026-34601, published 2026-04-02. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9,…
• CVE-2024-52011, published 2026-06-01. High severity, CVSS 8.3. EPSS: 0.5% chance of exploitation in the next 30 days. launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` argument in the `launchEditor`, an…
• CVE-2026-89091, published 2026-10-08. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation…
• CVE-2026-11332, published 2026-06-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument…