Red Hat Red Hat OpenShift Dev Spaces
13 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-107935 | | Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose | CRITICAL 9.3 | 0.2 % | ||
| CVE-2026-91142 | | Cockpit: cockpit: unauthorized modification of login records via integer overflow | LOW 3.6 | 0.1 % | ||
| CVE-2026-91147 | | Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-91149 | | Cockpit: cockpit: denial of service via unbounded connection thread spawning | HIGH 7.5 | 0.3 % | ||
| CVE-2025-11395 | | Podman: arbitrary file write when importing oci archive | MEDIUM 5.5 | 0.4 % | ||
| CVE-2026-79699 | | Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-79705 | | Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers | MEDIUM 4.5 | 0.4 % | ||
| CVE-2026-76235 | | Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html | HIGH 7.5 | 0.6 % | ||
| CVE-2026-19730 | | Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives | MEDIUM 4.2 | 0.1 % | ||
| CVE-2025-14969 | | Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect | MEDIUM 4.3 | 0.4 % | ||
| CVE-2025-11065 | | Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-0603 | | Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection | HIGH 8.3 | 1.0 % | ||
| CVE-2025-57850 | | Codeready-ws: privilege escalation via excessive /etc/passwd permissions | MEDIUM 6.4 | 0.2 % |