TI-2026-28350 CVE-2026-39363 · GHSA-p9ff-h696-f583
Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
Priority HIGH 75
Vite is a frontend tooling framework for JavaScript.
RHSA-2026:24761
Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Released 2026-06-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.29-2.el8ap, automation-gateway-proxy-server-2.5.10-6.el8ap, automation-gateway-server-2.5.20260422-3.el8ap +4
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.29-2.el9ap, automation-gateway-proxy-server-2.6.14-3.el9ap, automation-gateway-server-2.5.20260422-3.el9ap +4
Fixes 16 records
TI-2026-26254 CVE-2026-33896 · GHSA-2328-f5f3-gj25
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
Priority HIGH 74
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-26253 CVE-2026-33895 · GHSA-q67f-28xg-22rw
Forge has signature forgery in Ed25519 due to missing S > L check
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-26252 CVE-2026-33894 · GHSA-ppp5-5v6c-4jwp
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-26249 CVE-2026-33891 · GHSA-5m6q-g25r-mvwx
Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
Priority HIGH 72
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.
TI-2026-23747 CVE-2026-30922 · GHSA-jr27-m4p2-rc6r
pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
TI-2026-06360 CVE-2026-7246
[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
Priority HIGH 67
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project.
TI-2025-38908 CVE-2025-62718 · GHSA-3p68-rc4w-qgx5
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Priority HIGH 67
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-22248 CVE-2026-27904 · GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
TI-2026-29006 CVE-2026-40192 · GHSA-whj4-6x5x-4v2j
Pillow is vulnerable to a FITS GZIP decompression bomb
Priority MEDIUM 45
Pillow is a Python imaging library.
TI-2026-21474 CVE-2026-26996 · GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
TI-2026-24812 CVE-2026-32283 · GHSA-jrg3-gfjw-hm96
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
Priority MEDIUM 40
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.
TI-2026-24809 CVE-2026-32280 · GHSA-m4pr-4j3g-9v7v
Unexpected work during chain building in crypto/x509
Priority MEDIUM 40
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.
TI-2026-04296 CVE-2026-4926 · GHSA-j3q9-mxjg-w52f
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Priority MEDIUM 40
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`.
TI-2026-28770 CVE-2026-39892 · GHSA-p423-j2cm-9vmq
cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
Priority LOW 38
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
TI-2026-24811 CVE-2026-32282 · GHSA-xj38-jxc5-rppx
TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
Priority LOW 30
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.