TI-2026-21992 CVE-2026-27606 · GHSA-mw96-cpmx-2vgc
Rollup 4 has Arbitrary File Write via Path Traversal
Priority HIGH 79
Rollup is a module bundler for JavaScript.
RHSA-2026:13512
Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Released 2026-05-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.28-3.el8ap, automation-gateway-proxy-2.5.10-5.el8ap, automation-gateway-proxy-server-2.5.10-5.el8ap +19
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.28-3.el9ap, automation-gateway-proxy-2.6.14-2.el9, automation-gateway-proxy-server-2.6.14-2.el9 +19
Fixes 12 records
TI-2026-25107 CVE-2026-32597 · GHSA-752w-5fwx-jx9f
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
Priority HIGH 72
PyJWT is a JSON Web Token implementation in Python.
TI-2026-23747 CVE-2026-30922 · GHSA-jr27-m4p2-rc6r
pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
TI-2026-18923 CVE-2026-23490 · GHSA-63vm-454h-vhhq
pyasn1 has a DoS vulnerability in decoder
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
TI-2025-42946 CVE-2025-69873 · GHSA-2g4f-4pwh-qvx6
Regular expression denial of service in ajv.js ajv
Priority HIGH 72
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
TI-2025-42876 CVE-2025-69534 · GHSA-5wmx-573v-2qwq
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences…
Priority HIGH 72
Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing.
TI-2026-28360 CVE-2026-39373 · GHSA-fjrm-76x2-c4q4
JWCrypto: JWE ZIP decompression bomb
Priority MEDIUM 63
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.
TI-2026-23219 CVE-2026-29074 · GHSA-xpqw-6gx7-v673
SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
Priority MEDIUM 40
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
TI-2026-05494 CVE-2026-6266 · GHSA-6hqg-wj7g-983r
Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking
Priority LOW 38
A flaw was found in the AAP gateway.
TI-2026-21021 CVE-2026-26007 · GHSA-r6ph-v2qm-q3c2
cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Priority LOW 36
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
TI-2026-21866 CVE-2026-27459 · GHSA-5pwr-322w-8jr4
pyOpenSSL DTLS cookie callback buffer overflow
Priority LOW 35
pyOpenSSL is a Python wrapper around the OpenSSL library.