TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:17448
OpenShift Container Platform 4.18.42 bug fix and security update
Released 2026-05-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-csi-driver-nfs-rhel9, registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9, registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9-operator +1
Fixes 4 records
TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-26368 CVE-2026-34043 · GHSA-qj8w-gfj5-8c6v
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
Priority LOW 33
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.