TI-2026-30422 CVE-2026-42043 · GHSA-pmwg-cvhr-8vh7
Server-side request forgery in axios
Priority HIGH 82
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:25273
Red Hat Advanced Cluster Management for Kubernetes v2.16.2 security update
Released 2026-06-11 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9
Fixes 13 records
TI-2026-30423 CVE-2026-42044 · GHSA-3w6x-2g7m-8v23
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30418 CVE-2026-42039 · GHSA-62hf-57xw-28j9
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Priority HIGH 70
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9
Axios: Header Injection via Prototype Pollution
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30412 CVE-2026-42033 · GHSA-pf86-5x62-jrwf
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30420 CVE-2026-42041 · GHSA-w9j2-pvgh-6h63
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Priority MEDIUM 62
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-26188 CVE-2026-33816 · GHSA-9jj7-4m8r-rfcm
CVE-2026-33816 in github.com/jackc/pgx
Priority MEDIUM 50
Memory-safety vulnerability in github.com/jackc/pgx/v5.
TI-2026-26187 CVE-2026-33815 · GHSA-xgrm-4fwx-7qm8
CVE-2026-33815 in github.com/jackc/pgx
Priority MEDIUM 50
Memory-safety vulnerability in github.com/jackc/pgx/v5.
TI-2026-30144 CVE-2026-41602 · GHSA-wf45-q9ch-q8gh
Apache Thrift: Go TFramedTransport uint32 overflow
Priority MEDIUM 41
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0.
TI-2025-30732 CVE-2025-48431 · GHSA-ppv5-592p-g5q4
Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
Priority MEDIUM 41
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.
TI-2026-31933 CVE-2026-43869 · GHSA-7pwc-h2j2-rjgj
Apache Thrift: TSSLTransportFactory.java hostname verification
Priority LOW 39
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.
TI-2026-29551 CVE-2026-40895
follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets
Priority LOW 31
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.