Migration Toolkit Virtualization (Redhat) - vulnerabilities (CVEs)

30 CVEs, 2 in the last 30 days, 5 known versions, newest CVE from 2026-10-15. Vendor: Redhat.

CVEs of Migration Toolkit Virtualization

CVE-2026-92982 - CVSS 8.5 (high), 2026-10-15: A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious…
CVE-2026-89091 - CVSS 8.8 (high), 2026-10-08: A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using…
CVE-2026-11332 - CVSS 7.8 (high), 2026-06-05: A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to…
CVE-2026-8643 - CVSS 8 (high), 2026-06-01: pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory,…
CVE-2026-44432 - CVSS 8.9 (high), 2026-05-13: urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1)…
CVE-2026-40895 - CVSS 7.5 (high), 2026-04-21: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an…
CVE-2026-34986 - CVSS 7.5 (high), 2026-04-06: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE),…
CVE-2026-34742 - CVSS 8.1 (high), 2026-04-02: The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by…
CVE-2026-4800 - CVSS 9.8 (critical), 2026-03-31: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both…
CVE-2026-4926 - CVSS 7.5 (high), 2026-03-26: Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated…
CVE-2026-4602 - CVSS 8.7 (high), 2026-03-23: Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in…
CVE-2026-4601 - CVSS 9.4 (critical), 2026-03-23: Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA…
CVE-2026-4600 - CVSS 9.1 (critical), 2026-03-23: Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in…
CVE-2026-4599 - CVSS 9.3 (critical), 2026-03-23: Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the…
CVE-2026-4598 - CVSS 8.7 (high), 2026-03-23: Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse…
CVE-2026-33186 - CVSS 9.1 (critical), 2026-03-20: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the…
CVE-2026-30922 - CVSS 7.5 (high), 2026-03-18: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled…
CVE-2026-29063 - CVSS 9.8 (critical), 2026-03-06: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via…
CVE-2026-27896 - CVSS 7.5 (high), 2026-02-26: The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library…
CVE-2026-1615 - CVSS 9.8 (critical), 2026-02-09: Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The…
CVE-2025-61140 - CVSS 9.8 (critical), 2026-01-28: The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.
CVE-2026-24049 - CVSS 7.1 (high), 2026-01-22: wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable…
CVE-2025-13465 - CVSS 8.2 (high), 2026-01-21: The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from…
CVE-2025-56005 - CVSS 9.8 (critical), 2026-01-20: An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()`…
CVE-2026-23490 - CVSS 7.5 (high), 2026-01-16: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed…
CVE-2026-22029 - CVSS 8 (high), 2026-01-10: React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA…
CVE-2025-61686 - CVSS 9.1 (critical), 2026-01-10: React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to…
CVE-2026-21441 - CVSS 8.9 (high), 2026-01-07: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in…
CVE-2024-11831 - CVSS 5.4 (medium), 2025-02-10: A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such…
CVE-2024-8509 - CVSS 7.5 (high), 2024-09-06: A vulnerability was found in Forklift Controller. There is no verification against the authorization header except to ensure it uses bearer authentication.…