TI-2026-21992 CVE-2026-27606 · GHSA-mw96-cpmx-2vgc
Rollup 4 has Arbitrary File Write via Path Traversal
Priority HIGH 79
Rollup is a module bundler for JavaScript.
RHSA-2026:13508
Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Released 2026-05-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.4-3.el10ap, receptorctl-1.6.4-3.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.11-2.el9ap, automation-controller-cli-4.7.11-2.el9ap, automation-controller-server-4.7.11-2.el9ap +25
Fixes 12 records
TI-2026-25107 CVE-2026-32597 · GHSA-752w-5fwx-jx9f
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
Priority HIGH 72
PyJWT is a JSON Web Token implementation in Python.
TI-2026-23747 CVE-2026-30922 · GHSA-jr27-m4p2-rc6r
pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
TI-2026-18923 CVE-2026-23490 · GHSA-63vm-454h-vhhq
pyasn1 has a DoS vulnerability in decoder
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
TI-2025-42876 CVE-2025-69534 · GHSA-5wmx-573v-2qwq
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences…
Priority HIGH 72
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing.
TI-2026-28360 CVE-2026-39373 · GHSA-fjrm-76x2-c4q4
JWCrypto: JWE ZIP decompression bomb
Priority MEDIUM 63
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.
TI-2026-21474 CVE-2026-26996 · GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
TI-2026-10631 CVE-2026-12382 · GHSA-45w6-c976-v24q
Aap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing
Priority MEDIUM 42
A flaw was found in the AAP Gateway Envoy proxy configuration.
TI-2025-13292 CVE-2025-14550 · GHSA-33mw-q7rj-mjwj
Potential denial-of-service vulnerability via repeated headers when using ASGI
Priority MEDIUM 41
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
TI-2026-05494 CVE-2026-6266 · GHSA-6hqg-wj7g-983r
Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking
Priority LOW 38
A flaw was found in the AAP gateway.
TI-2026-21866 CVE-2026-27459 · GHSA-5pwr-322w-8jr4
pyOpenSSL DTLS cookie callback buffer overflow
Priority LOW 35
pyOpenSSL is a Python wrapper around the OpenSSL library.