TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7
Server-side request forgery in axios
Priority HIGH 82
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:22619
Red Hat Data Grid 8.6.1 security update
Released 2026-06-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Data Grid 8.6.1
Fixes 12 records
TI-2026-26231 CVE-2026-33870 · GHSA-pwqr-wmgm-9rr8
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Priority HIGH 70
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30420 CVE-2026-42041 · GHSA-w9j2-pvgh-6h63
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Priority MEDIUM 62
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-29849 CVE-2026-41240 · GHSA-h7mw-gpvr-xq4m
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Priority MEDIUM 60
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.
TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
TI-2026-26232 CVE-2026-33871 · GHSA-w9fj-cfpg-grvv
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
Priority MEDIUM 46
Netty is an asynchronous, event-driven network application framework.
TI-2026-26738 CVE-2026-34480 · GHSA-3pxv-7cmr-fjr4
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Priority LOW 39
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w…
TI-2026-26736 CVE-2026-34478 · GHSA-445c-vh5m-36rj
Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
Priority LOW 38
Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames…
TI-2026-29626 CVE-2026-40975 · GHSA-m4x9-hx6x-2c43
Values produced by ${random.value} are not suitable for use as secrets.
Priority LOW 33
Values produced by ${random.value} are not suitable for use as secrets.
TI-2026-26739 CVE-2026-34481 · GHSA-w35j-pv5h-q9q9
Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout
Priority LOW 29
Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-p…