Skip to content
OpenAdvisories
High ELSA-2026-19008 1 CVE

Important: pcs security update (Oracle Linux 10)

Published Jul 17, 2026 · Updated Jul 17, 2026

Ecosystem: Oracle Linux

Summary

[0.12.2-3.el10_2.1]
- Fixed CVE-2026-4800 by updating HA Cluster Management add-on to 0.1.24.3
Resolves: RHEL-164079

[0.12.2-3]
- Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.24.2
Resolves: RHEL-144191

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 10 cockpit-ha-cluster 0:0.12.2-3.el10_2.1
Oracle Linux · 10 pcs 0:0.12.2-3.el10_2.1
Oracle Linux · 10 pcs-snmp 0:0.12.2-3.el10_2.1

Vulnerabilities 1

  • High 8.1
    CVE-2026-4800 Public exploit

    lodash vulnerable to Code Injection via `_.template` imports key names

    The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm