CVE-2026-25679, CVE-2026-27145, CVE-2026-27727 +20 more CVEs: go-jose from 3.0.0 (inclusive), before 3.0.5 (exclusive), from 4.0.0 (inclusive), before 4.1.4…

CVE-2026-25679

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Microsoft Security Response Center, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Microsoft Security Response Center’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-27145

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality impact as none; integrity impact as low; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-27727

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-32280

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-32281

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-32282

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Local · High privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-32283

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-33186

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Microsoft Security Response Center, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Microsoft Security Response Center’s CVSS 3.1 assessment rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-33810

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and availability impact as none; integrity impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-33811

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-34986

Affected technology

go-jose · from 3.0.0 (inclusive), before 3.0.5 (exclusive)
go-jose project

go-jose · from 4.0.0 (inclusive), before 4.1.4 (exclusive)
go-jose project

go-jose · >= 4.0.0, < 4.1.4, < 3.0.5
go-jose

Cryostat 4 on RHEL 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 10 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 10.0 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.8 Telecommunications Update Service · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9 · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.4 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions · Exact affected versions not specified by the source
Red Hat

Red Hat Enterprise Linux 9.6 Extended Update Support · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.12 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.13 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.16 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.18 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.19 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.20 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.21 · Exact affected versions not specified by the source
Red Hat

Custom Metric Autoscaler 2.19 · Exact affected versions not specified by the source
Red Hat

Logging for Red Hat OpenShift 6 · Exact affected versions not specified by the source
Red Hat

Logging for Red Hat OpenShift 6.2 · Exact affected versions not specified by the source
Red Hat

Logging Subsystem for Red Hat OpenShift 6.4 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.1 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.11 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.6 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.7 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.8 · Exact affected versions not specified by the source
Red Hat

multicluster engine for Kubernetes 2.9 · Exact affected versions not specified by the source
Red Hat

Multicluster Global Hub 1.3.4 · Exact affected versions not specified by the source
Red Hat

Multicluster Global Hub 1.4.5 · Exact affected versions not specified by the source
Red Hat

Multicluster Global Hub 1.6.5 · Exact affected versions not specified by the source
Red Hat

OpenShift API for Data Protection 1.3 · Exact affected versions not specified by the source
Red Hat

OpenShift API for Data Protection 1.4 · Exact affected versions not specified by the source
Red Hat

OpenShift API for Data Protection 1.5 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2.14 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Security 4.8 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Security 4.9 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Security for Kubernetes 4.10 · Exact affected versions not specified by the source
Red Hat

Red Hat Migration Toolkit 1.8 · Exact affected versions not specified by the source
Red Hat

Red Hat multicluster global hub 1.5.3 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift AI 2.25 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift AI 3.3 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.17 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4.22 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.17 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.18 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.19 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.20 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.21 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4.22 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Dev Spaces 3.27 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Dev Spaces 3.29 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Dev Spaces 3.30 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift distributed tracing 3.9.3 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift GitOps 1.18 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Pipelines 1.2 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Pipelines 1.21 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Service Mesh 2.6 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Service Mesh 3.1 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Service Mesh 3.2 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Service Mesh 3.3 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3.10 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3.12 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3.14 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3.15 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3.16 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3.17 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3.18 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3.9 · Exact affected versions not specified by the source
Red Hat

Red Hat Trusted Artifact Signer 1.3 · Exact affected versions not specified by the source
Red Hat

Assisted Installer for Red Hat OpenShift Container Platform 2 · Exact affected versions not specified by the source
Red Hat

cert-manager Operator for Red Hat OpenShift · Exact affected versions not specified by the source
Red Hat

Confidential Compute Attestation · Exact affected versions not specified by the source
Red Hat

External Secrets Operator for Red Hat OpenShift · Exact affected versions not specified by the source
Red Hat

Kernel Module Management Operator for Red Hat Openshift · Exact affected versions not specified by the source
Red Hat

Logging Subsystem for Red Hat OpenShift · Exact affected versions not specified by the source
Red Hat

Logical Volume Manager Storage · Exact affected versions not specified by the source
Red Hat

Migration Toolkit for Containers · Exact affected versions not specified by the source
Red Hat

Migration Toolkit for Virtualization · Exact affected versions not specified by the source
Red Hat

Multicluster Engine for Kubernetes · Exact affected versions not specified by the source
Red Hat

Multicluster Global Hub · Exact affected versions not specified by the source
Red Hat

Network Observability Operator · Exact affected versions not specified by the source
Red Hat

Node HealthCheck Operator · Exact affected versions not specified by the source
Red Hat

OpenShift Developer Tools and Services · Exact affected versions not specified by the source
Red Hat

OpenShift Lightspeed · Exact affected versions not specified by the source
Red Hat

OpenShift Pipelines · Exact affected versions not specified by the source
Red Hat

OpenShift Serverless · Exact affected versions not specified by the source
Red Hat

OpenShift Service Mesh 2 · Exact affected versions not specified by the source
Red Hat

OpenShift Service Mesh 3 · Exact affected versions not specified by the source
Red Hat

Power monitoring for Red Hat OpenShift · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Management for Kubernetes 2 · Exact affected versions not specified by the source
Red Hat

Red Hat Advanced Cluster Security 4 · Exact affected versions not specified by the source
Red Hat

Red Hat Ansible Automation Platform 2 · Exact affected versions not specified by the source
Red Hat

Red Hat Build of Kueue · Exact affected versions not specified by the source
Red Hat

Red Hat Build of Podman Desktop · Exact affected versions not specified by the source
Red Hat

Red Hat Build of Podman Desktop - Tech Preview · Exact affected versions not specified by the source
Red Hat

Red Hat Connectivity Link 1 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift AI (RHOAI) · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Cluster Manager CLI · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Container Platform 4 · Exact affected versions not specified by the source
Red Hat

Red Hat Openshift Data Foundation 4 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Dev Spaces · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift for Windows Containers · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift GitOps · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift on AWS · Exact affected versions not specified by the source
Red Hat

Red Hat OpenShift Virtualization 4 · Exact affected versions not specified by the source
Red Hat

Red Hat OpenStack Platform 18.0 · Exact affected versions not specified by the source
Red Hat

Red Hat Quay 3 · Exact affected versions not specified by the source
Red Hat

Red Hat Trusted Artifact Signer · Exact affected versions not specified by the source
Red Hat

Security Profiles Operator · Exact affected versions not specified by the source
Red Hat

Zero Trust Workload Identity Manager · Exact affected versions not specified by the source
Red Hat

Zero Trust Workload Identity Manager - Tech Preview · Exact affected versions not specified by the source
Red Hat

Component: Not specified by the source
Function: directly

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service under the conditions described by the source. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high. Source advisory’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.

CVE-2026-39820

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-39821

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-39829

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-39830

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-40192

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-42499

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-42504

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-48526

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-5135

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-5136

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-5138

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

CVE-2026-5142

Affected technology

Product not specified by the source · Exact affected versions not specified by the source
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (OSV, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

OSV’s CVSS 3.1 assessment rates confidentiality impact as high; integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.