RH
Product
Red Hat Ansible Automation Platform 2.1
14
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 8High 6Medium 0Low 0
Watch
Add Red Hat Ansible Automation Platform 2.1 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-44005 | 10.0 | May 13 | vm2: Sandbox escape Affected: All versions, or not specified |
| CVE-2026-44006 | 10.0 | May 13 | vm2: Sandbox Escape Affected: All versions, or not specified |
| CVE-2026-43997 | 10.0 | May 13 | vm2: Sandbox Escape Affected: All versions, or not specified |
| CVE-2026-43999 | 9.9 | May 13 | vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape Affected: All versions, or not specified |
| CVE-2026-45411 | 9.8 | May 13 | vm2: Sandbox Breakout Using Async Generator Affected: All versions, or not specified |
| CVE-2026-44009 | 9.8 | May 13 | vm2: Sandbox Breakout Through Null Proto Exception Affected: All versions, or not specified |
| CVE-2026-44008 | 9.8 | May 13 | vm2: Snabox breakout via `neutralizeArraySpeciesBatch` Affected: All versions, or not specified |
| CVE-2026-44007 | 9.1 | May 13 | vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution Affected: All versions, or not specified |
| CVE-2026-44001 | 8.6 | May 13 | vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) Affected: All versions, or not specified |
| CVE-2026-43998 | 8.5 | May 13 | vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape Affected: All versions, or not specified |
| CVE-2026-9277 | 8.1 | May 22 | shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op` Affected: All versions, or not specified |
| CVE-2026-12143 | 7.5 | Jun 12 | form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) Affected: All versions, or not specified |
| CVE-2026-46625 | 7.5 | Jun 10 | JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection Affected: All versions, or not specified |
| CVE-2026-44004 | 7.5 | May 13 | vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass) Affected: All versions, or not specified |
Showing 14