TI-2026-19118 CVE-2026-23745 · GHSA-8qq5-rm4j-mr97
node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Priority HIGH 69
node-tar is a Tar for Node.js.
RHSA-2026:2144
RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
Released 2026-02-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +7
Fixes 12 records
TI-2026-18290 CVE-2026-22772 · GHSA-59jp-pj84-45mr
Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
Priority HIGH 65
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
TI-2025-40854 CVE-2025-66418 · GHSA-gm62-xv2j-4w53
urllib3 allows an unbounded number of links in the decompression chain
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
TI-2026-18293 CVE-2026-22775 · GHSA-g2pg-6438-jwpf
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
Priority MEDIUM 40
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job.
TI-2026-18292 CVE-2026-22774 · GHSA-vw5p-8cq8-m7mv
devalue vulnerable to denial of service due to memory exhaustion in devalue.parse
Priority MEDIUM 40
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job.
TI-2025-40898 CVE-2025-66471 · GHSA-2xpw-w6gg-jr37
urllib3 Streaming API improperly handles highly compressed data
Priority MEDIUM 40
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-40094 CVE-2025-64756 · GHSA-5j98-mcp5-4vw2
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Priority MEDIUM 40
Glob matches files using patterns the shell uses.
TI-2025-40975 CVE-2025-66564 · GHSA-4qg8-fj49-pxjh
Sigstore Timestamp Authority allocates excessive memory during request parsing
Priority LOW 39
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.
TI-2026-19292 CVE-2026-23950 · GHSA-r6q2-hw4h-h46w
node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS
Priority LOW 38
node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3.
TI-2025-40928 CVE-2025-66506 · GHSA-f83f-xpx7-ffpw
Fulcio allocates excessive memory during token parsing
Priority LOW 38
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
TI-2025-38131 CVE-2025-61729 · GHSA-7c64-f9jr-v9h2
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.