RH
Product
Red Hat Advanced Cluster Management for Kubernetes 2.14
74
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 18High 36Medium 20Low 0
Watch
Add Red Hat Advanced Cluster Management for Kubernetes 2.14 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-42043 | 10.0 | Apr 24 | Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 Affected: All versions, or not specified |
| CVE-2026-67567 | 9.9 | Aug 20 | Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction Affected: All versions, or not specified |
| CVE-2026-70496 | 9.9 | Aug 19 | Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork Affected: All versions, or not specified |
| CVE-2026-66792 | 9.9 | Aug 17 | Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters Affected: All versions, or not specified |
| CVE-2026-72508 | 9.9 | Aug 12 | Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*) Affected: All versions, or not specified |
| CVE-2026-72526 | 9.9 | Aug 12 | Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation Affected: All versions, or not specified |
| CVE-2025-62718 | 9.9 | Apr 9 | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF Affected: All versions, or not specified |
| CVE-2026-35579 | 9.8 | May 5 | CoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports Affected: All versions, or not specified |
| CVE-2026-33815 | 9.8 | Apr 7 | CVE-2026-33815 in github.com/jackc/pgx Affected: All versions, or not specified |
| CVE-2026-29063 | 9.8 | Mar 6 | Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable Affected: All versions, or not specified |
| CVE-2026-70398 | 9.6 | Aug 12 | Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace Affected: All versions, or not specified |
| CVE-2026-44990 | 9.3 | Jun 12 | Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` Affected: All versions, or not specified |
| CVE-2026-71470 | 9.1 | Aug 19 | Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa Affected: All versions, or not specified |
| CVE-2026-71472 | 9.1 | Aug 17 | Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem Affected: All versions, or not specified |
| CVE-2026-42044 | 9.1 | Apr 24 | Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` Affected: All versions, or not specified |
| CVE-2026-33186 | 9.1 | Mar 20 | gRPC-Go has an authorization bypass via missing leading slash in :path Affected: All versions, or not specified |
| CVE-2026-71471 | 9.0 | Aug 12 | Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image Affected: All versions, or not specified |
| CVE-2026-10090 | 9.0 | Aug 5 | Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit user can deploy cluster-scoped clusterrolebinding and become cluster-admin via application subscription Affected: All versions, or not specified |
Showing 18