TI-2026-30191 CVE-2026-41674 · GHSA-f6ww-3ggp-fr8h
xmldom: XML injection through unvalidated DocumentType serialization
Priority HIGH 77
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.
RHSA-2026:20034
OpenShift Container Platform 4.21.17 bug fix and security update
Released 2026-05-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-api-rhel9 +15
Fixes 6 records
TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2026-27599 CVE-2026-35469 · GHSA-pc3f-x583-g7j2
SpdyStream: DOS on CRI
Priority MEDIUM 45
spdystream is a Go library for multiplexing streams over SPDY connections.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2025-35990 CVE-2025-58183 · GHSA-9gcr-gp5f-jw27
Unbounded allocation when parsing GNU sparse map in archive/tar
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.