TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:10131
RHTAS 1.3.4 - Red Hat Trusted Artifact Signer Release
Released 2026-04-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
Fixes 2 records
TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.