Self-service automation portal 2 vulnerabilities

43 known vulnerabilities in Self-service automation portal 2 from Red Hat. 43 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  fast-xml-parser: Improper Restriction of Recursive Entity References in DTDs

  CVE-2026-26278Feb 19, 2026NaturalIntelligence

  fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a

• 9.8 Critical severity

  jsonpath: Improper Control of Generation of Code

  CVE-2026-1615Feb 9, 2026JsonpathEPSS 1.15%

  Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions. The library relies on the static-eval module to process JSON Path input, which is not designed to handle untr

• 8.8 High severity

  backstage: Improper Control of Generation of Code

  CVE-2026-25153Jan 30, 2026Backstage

  Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is configured wit