TI-2025-40914 CVE-2025-66490 · GHSA-gm3x-23wp-hc2c
Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules
Priority HIGH 70
Traefik is an HTTP reverse proxy and load balancer.
RHSA-2026:2456
Red Hat OpenShift Dev Spaces 3.26.0 Release.
Released 2026-02-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
Fixes 14 records
TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
TI-2025-40854 CVE-2025-66418 · GHSA-gm62-xv2j-4w53
urllib3 allows an unbounded number of links in the decompression chain
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-40557 CVE-2025-66031 · GHSA-554w-wpv2-vw27
node-forge ASN.1 Unbounded Recursion
Priority MEDIUM 44
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2025-11739 CVE-2025-12816 · GHSA-5gfm-wpxj-wjgq
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and…
Priority MEDIUM 44
An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…
TI-2025-40898 CVE-2025-66471 · GHSA-2xpw-w6gg-jr37
urllib3 Streaming API improperly handles highly compressed data
Priority MEDIUM 40
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-40094 CVE-2025-64756 · GHSA-5j98-mcp5-4vw2
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Priority MEDIUM 40
Glob matches files using patterns the shell uses.
TI-2026-17723 CVE-2026-22029 · GHSA-2w69-qvjg-hvjx
React Router vulnerable to XSS via Open Redirects
Priority LOW 38
React Router is a router for React.
TI-2025-40515 CVE-2025-65945 · GHSA-869p-cjfg-cm3x
auth0/node-jws improper HMAC signature verification vulnerability
Priority LOW 38
auth0/node-jws is a JSON Web Signature implementation for Node.js.
TI-2025-32917 CVE-2025-52881 · GHSA-cgrx-mc8f-2prm
runc: LSM labels can be bypassed with malicious config using dummy procfs files
Priority LOW 35
runc is a CLI tool for spawning and running containers according to the OCI specification.
TI-2024-16849 CVE-2024-25621 · GHSA-pwhc-rpq9-4c8w
containerd affected by a local privilege escalation via wide permissions on CRI directory
Priority LOW 35
containerd is an open-source container runtime.
TI-2025-13959 CVE-2025-15284 · GHSA-6rw7-vpxm-498p
arrayLimit bypass in bracket notation allows DoS via memory exhaustion
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
TI-2025-38131 CVE-2025-61729 · GHSA-7c64-f9jr-v9h2
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
TI-2025-35990 CVE-2025-58183 · GHSA-9gcr-gp5f-jw27
Unbounded allocation when parsing GNU sparse map in archive/tar
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.