TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
RHSA-2026:21931
Red Hat OpenShift Pipelines Release 1.20.5
Released 2026-05-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Pipelines 1.20 registry.redhat.io/openshift-pipelines/pipelines-console-plugin-rhel9, registry.redhat.io/openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9
Fixes 7 records
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2026-25632 CVE-2026-33211 · GHSA-j5q5-j9gm-2w5c
Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod
Priority MEDIUM 42
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.
TI-2026-01876 CVE-2026-2229 · GHSA-v9p9-hfj2-hcw8
undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
Priority MEDIUM 41
ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension.
TI-2026-01216 CVE-2026-1526 · GHSA-vrm6-8vpv-qv8q
undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
Priority MEDIUM 41
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-01218 CVE-2026-1528 · GHSA-f269-vfmq-vjvj
undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
Priority MEDIUM 40
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length.