# Red Hat Developer Hub vulnerabilities Source: https://junglewise.ai/threats/technologies/developer-hub Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/developer-hub.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 28 vulnerabilities in Red Hat Developer Hub: 0 in the last 7 days and 0 in the last 90 days, 10 of them critical and 0 exploited in the wild. The most recent, CVE-2026-43999, was published on 13 May 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 28 (10 critical, 0 exploited in the wild) ## About Red Hat Developer Hub Developer Hub is a Red Hat web-based application for developer tools and documentation access. ## Latest Red Hat Developer Hub vulnerabilities - [CVE-2026-43999: patriksimek vm2 remote code execution via NodeVM allowlist bypass](https://junglewise.ai/threats/cve-2026-43999-patriksimek-vm2-remote-code-execution-via-nodevm-allowlist-bypass) (critical, CVSS 9.9, published 13 May 2026) - [CVE-2026-43998: patriksimek vm2 remote code execution via symlink traversal in NodeVM](https://junglewise.ai/threats/cve-2026-43998-patriksimek-vm2-remote-code-execution-via-symlink-traversal-in) (high, CVSS 8.5, published 13 May 2026) - [CVE-2026-44293: protobufjs code injection in toObject function generation](https://junglewise.ai/threats/cve-2026-44293-protobufjs-code-injection-in-toobject-function-generation) (high, CVSS 8.8, published 13 May 2026) - [CVE-2026-6322: Fastify fast-uri host confusion via percent-encoded authority delimiters](https://junglewise.ai/threats/cve-2026-6322-fastify-fast-uri-host-confusion-via-percent-encoded-authority) (high, CVSS 7.5, published 5 May 2026) - [CVE-2026-6321: OpenJS Foundation fast-uri path traversal via percent-encoded dot segments](https://junglewise.ai/threats/cve-2026-6321-openjs-foundation-fast-uri-path-traversal-via-percent-encoded-dot) (high, CVSS 7.5, published 4 May 2026) - [CVE-2026-26956: patriksimek vm2 sandbox escape via WebAssembly JSTag](https://junglewise.ai/threats/cve-2026-26956-patriksimek-vm2-sandbox-escape-via-webassembly-jstag) (critical, CVSS 9.8, published 4 May 2026) - [CVE-2026-26332: patriksimek vm2 sandbox escape via SuppressedError](https://junglewise.ai/threats/cve-2026-26332-patriksimek-vm2-sandbox-escape-via-suppressederror) (critical, CVSS 9.8, published 4 May 2026) - [CVE-2026-24120: patriksimek vm2 sandbox escape via Promise species bypass](https://junglewise.ai/threats/cve-2026-24120-patriksimek-vm2-sandbox-escape-via-promise-species-bypass) (critical, CVSS 9.8, published 4 May 2026) - [CVE-2026-24118: patriksimek vm2 sandbox breakout via descriptor-chain bypass](https://junglewise.ai/threats/cve-2026-24118-patriksimek-vm2-sandbox-breakout-via-descriptor-chain-bypass) (critical, CVSS 9.8, published 4 May 2026) - [CVE-2026-40906: ElectricSQL SQL injection in /v1/shape API order_by parameter](https://junglewise.ai/threats/cve-2026-40906-electricsql-sql-injection-in-v1-shape-api-order-by-parameter) (critical, CVSS 9.9, published 21 Apr 2026) - [CVE-2026-40895: follow-redirects sensitive header leak in cross-domain redirects](https://junglewise.ai/threats/cve-2026-40895-follow-redirects-sensitive-header-leak-in-cross-domain-redirects) (high, CVSS 7.5, published 21 Apr 2026) - [CVE-2026-39983: patrickjuchli basic-ftp FTP command injection via CRLF sequences](https://junglewise.ai/threats/cve-2026-39983-patrickjuchli-basic-ftp-ftp-command-injection-via-crlf-sequences) (high, CVSS 8.6, published 9 Apr 2026) - [CVE-2026-33896: Digital Bazaar node-forge certificate validation bypass in verifyCertificateChain](https://junglewise.ai/threats/cve-2026-33896-digital-bazaar-node-forge-certificate-validation-bypass-in) (high, CVSS 7.4, published 27 Mar 2026) - [CVE-2026-33894: Digital Bazaar node-forge signature forgery in RSASSA PKCS#1 v1.5](https://junglewise.ai/threats/cve-2026-33894-digital-bazaar-node-forge-signature-forgery-in-rsassa-pkcs-1-v1-5) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-33891: Digital Bazaar node-forge infinite loop in BigInteger.modInverse](https://junglewise.ai/threats/cve-2026-33891-digital-bazaar-node-forge-infinite-loop-in-biginteger-modinverse) (high, CVSS 7.5, published 27 Mar 2026) - [CVE-2026-4926: path-to-regexp denial of service via sequential optional groups](https://junglewise.ai/threats/cve-2026-4926-path-to-regexp-denial-of-service-via-sequential-optional-groups) (high, CVSS 7.5, published 26 Mar 2026) - [CVE-2026-33228: WebReflection flatted prototype pollution in parse function](https://junglewise.ai/threats/cve-2026-33228-webreflection-flatted-prototype-pollution-in-parse-function) (critical, CVSS 9.8, published 20 Mar 2026) - [CVE-2026-33001: Jenkins arbitrary file write via symbolic link extraction in archives](https://junglewise.ai/threats/cve-2026-33001-jenkins-arbitrary-file-write-via-symbolic-link-extraction-in) (high, CVSS 8.8, published 18 Mar 2026) - [CVE-2025-69196: PrefectHQ FastMCP improper resource handling in OAuth Proxy](https://junglewise.ai/threats/cve-2025-69196-prefecthq-fastmcp-improper-resource-handling-in-oauth-proxy) (medium, CVSS 6.5, published 16 Mar 2026) - [CVE-2026-29186: Backstage TechDocs arbitrary code execution via MkDocs configuration bypass](https://junglewise.ai/threats/cve-2026-29186-backstage-techdocs-arbitrary-code-execution-via-mkdocs) (high, CVSS 7.7, published 7 Mar 2026) - [CVE-2026-25896: NaturalIntelligence fast-xml-parser XSS via regex injection in DOCTYPE](https://junglewise.ai/threats/cve-2026-25896-naturalintelligence-fast-xml-parser-xss-via-regex-injection-in) (critical, CVSS 9.3, published 20 Feb 2026) - [CVE-2026-26318: sebhildebrandt systeminformation command injection in versions function](https://junglewise.ai/threats/cve-2026-26318-sebhildebrandt-systeminformation-command-injection-in-versions) (high, CVSS 8.8, published 19 Feb 2026) - [CVE-2026-26280: sebhildebrandt systeminformation command injection in wifiNetworks](https://junglewise.ai/threats/cve-2026-26280-sebhildebrandt-systeminformation-command-injection-in) (high, CVSS 8.4, published 19 Feb 2026) - [CVE-2026-26278: NaturalIntelligence fast-xml-parser denial of service via entity expansion](https://junglewise.ai/threats/cve-2026-26278-naturalintelligence-fast-xml-parser-denial-of-service-via-entity) (high, CVSS 7.5, published 19 Feb 2026) - [CVE-2026-1615: dchester jsonpath code injection via unsafe evaluation](https://junglewise.ai/threats/cve-2026-1615-dchester-jsonpath-code-injection-via-unsafe-evaluation) (critical, CVSS 9.8, published 9 Feb 2026) ## Most severe Red Hat Developer Hub vulnerabilities - [CVE-2026-43999: patriksimek vm2 remote code execution via NodeVM allowlist bypass](https://junglewise.ai/threats/cve-2026-43999-patriksimek-vm2-remote-code-execution-via-nodevm-allowlist-bypass) (critical, CVSS 9.9, published 13 May 2026) - [CVE-2026-40906: ElectricSQL SQL injection in /v1/shape API order_by parameter](https://junglewise.ai/threats/cve-2026-40906-electricsql-sql-injection-in-v1-shape-api-order-by-parameter) (critical, CVSS 9.9, published 21 Apr 2026) - [CVE-2026-1615: dchester jsonpath code injection via unsafe evaluation](https://junglewise.ai/threats/cve-2026-1615-dchester-jsonpath-code-injection-via-unsafe-evaluation) (critical, CVSS 9.8, published 9 Feb 2026) - [CVE-2026-33228: WebReflection flatted prototype pollution in parse function](https://junglewise.ai/threats/cve-2026-33228-webreflection-flatted-prototype-pollution-in-parse-function) (critical, CVSS 9.8, published 20 Mar 2026) - [CVE-2026-24118: patriksimek vm2 sandbox breakout via descriptor-chain bypass](https://junglewise.ai/threats/cve-2026-24118-patriksimek-vm2-sandbox-breakout-via-descriptor-chain-bypass) (critical, CVSS 9.8, published 4 May 2026) - [CVE-2026-24120: patriksimek vm2 sandbox escape via Promise species bypass](https://junglewise.ai/threats/cve-2026-24120-patriksimek-vm2-sandbox-escape-via-promise-species-bypass) (critical, CVSS 9.8, published 4 May 2026) - [CVE-2026-26956: patriksimek vm2 sandbox escape via WebAssembly JSTag](https://junglewise.ai/threats/cve-2026-26956-patriksimek-vm2-sandbox-escape-via-webassembly-jstag) (critical, CVSS 9.8, published 4 May 2026) - [CVE-2026-26332: patriksimek vm2 sandbox escape via SuppressedError](https://junglewise.ai/threats/cve-2026-26332-patriksimek-vm2-sandbox-escape-via-suppressederror) (critical, CVSS 9.8, published 4 May 2026) - [CVE-2025-61140: dchester jsonpath prototype pollution in value function](https://junglewise.ai/threats/cve-2025-61140-dchester-jsonpath-prototype-pollution-in-value-function) (critical, CVSS 9.8, published 28 Jan 2026) - [CVE-2026-25896: NaturalIntelligence fast-xml-parser XSS via regex injection in DOCTYPE](https://junglewise.ai/threats/cve-2026-25896-naturalintelligence-fast-xml-parser-xss-via-regex-injection-in) (critical, CVSS 9.3, published 20 Feb 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Red Hat technologies - [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9): 146 vulnerabilities - [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10): 140 vulnerabilities - [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8): 132 vulnerabilities - [Red Hat Keycloak](https://junglewise.ai/threats/technologies/red-hat-keycloak): 102 vulnerabilities - [Red Hat Enterprise Linux 7](https://junglewise.ai/threats/technologies/enterprise-linux-7): 68 vulnerabilities - [Red Hat Enterprise Linux 6](https://junglewise.ai/threats/technologies/enterprise-linux-6): 56 vulnerabilities - [Red Hat Build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-build-of-keycloak): 55 vulnerabilities - [Red Hat Enterprise Linux AppStream](https://junglewise.ai/threats/technologies/enterprise-linux-appstream): 46 vulnerabilities - [Red Hat Ansible Automation Platform](https://junglewise.ai/threats/technologies/ansible-automation-platform-2): 44 vulnerabilities - [Red Hat OpenShift Container Platform 4](https://junglewise.ai/threats/technologies/openshift-container-platform-4): 36 vulnerabilities - [Red Hat Quay](https://junglewise.ai/threats/technologies/quay-3-12): 20 vulnerabilities - [Red Hat Multicluster Global Hub](https://junglewise.ai/threats/technologies/multicluster-global-hub): 19 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Red Hat Developer Hub vulnerabilities", https://junglewise.ai/threats/technologies/developer-hub, 13 November 2026.