TI-2026-35991 CVE-2026-48710 · GHSA-86qp-5c8j-p5mr
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Priority CRITICAL 86KEV
Starlette is a lightweight ASGI framework/toolkit.
RHSA-2026:24866
Red Hat Ansible Automation Platform 2.6 Container Release Update
Released 2026-06-09 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +7
Fixes 14 records
TI-2026-28350 CVE-2026-39363 · GHSA-p9ff-h696-f583
Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
Priority HIGH 75
Vite is a frontend tooling framework for JavaScript.
TI-2026-29027 CVE-2026-40217 · GHSA-wxxx-gvqv-xp7p
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode…
Priority HIGH 73
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
TI-2026-18923 CVE-2026-23490 · GHSA-63vm-454h-vhhq
pyasn1 has a DoS vulnerability in decoder
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
TI-2026-25584 CVE-2026-33154 · GHSA-pxrr-hq57-q35p
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
Priority HIGH 70
dynaconf is a configuration management tool for Python.
TI-2026-28351 CVE-2026-39364 · GHSA-v2wj-q39q-566r
Vite has a `server.fs.deny` bypass with queries
Priority HIGH 69
Vite is a frontend tooling framework for JavaScript.
TI-2025-38908 CVE-2025-62718 · GHSA-3p68-rc4w-qgx5
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Priority HIGH 67
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-22899 CVE-2026-28684 · GHSA-mf9w-mj56-hr94
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
Priority MEDIUM 64
python-dotenv reads key-value pairs from a .env file and can set them as environment variables.
TI-2026-29006 CVE-2026-40192 · GHSA-whj4-6x5x-4v2j
Pillow is vulnerable to a FITS GZIP decompression bomb
Priority MEDIUM 45
Pillow is a Python imaging library.
TI-2026-22665 CVE-2026-28390 · GHSA-fgpp-q3px-3xhc
Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
Priority MEDIUM 40
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.
TI-2026-05545 CVE-2026-6321 · GHSA-q3j6-qgpj-74h6
fast-uri vulnerable to path traversal via percent-encoded dot segments
Priority MEDIUM 40
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.
TI-2026-04296 CVE-2026-4926 · GHSA-j3q9-mxjg-w52f
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Priority MEDIUM 40
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`.
TI-2026-28770 CVE-2026-39892 · GHSA-p423-j2cm-9vmq
cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
Priority LOW 38
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
TI-2026-29768 CVE-2026-41140 · GHSA-73h3-mf4w-8647
Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
Priority LOW 5
Poetry is a dependency manager for Python.