TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:21658
OpenShift Container Platform 4.18.43 security and extras update
Released 2026-06-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator +5
Fixes 8 records
TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2026-27599 CVE-2026-35469 · GHSA-pc3f-x583-g7j2
SpdyStream: DOS on CRI
Priority MEDIUM 45
spdystream is a Go library for multiplexing streams over SPDY connections.
TI-2025-12309 CVE-2025-13465 · GHSA-xxjr-mmjv-4gpg
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
TI-2026-17723 CVE-2026-22029 · GHSA-2w69-qvjg-hvjx
React Router vulnerable to XSS via Open Redirects
Priority LOW 38
React Router is a router for React.
TI-2025-13959 CVE-2025-15284 · GHSA-6rw7-vpxm-498p
arrayLimit bypass in bracket notation allows DoS via memory exhaustion
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
TI-2025-35990 CVE-2025-58183 · GHSA-9gcr-gp5f-jw27
Unbounded allocation when parsing GNU sparse map in archive/tar
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.