TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9
Axios: Header Injection via Prototype Pollution
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:26010
Cluster Observability Operator 1.5.0
Released 2026-06-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +5
Fixes 4 records
TI-2025-38908 CVE-2025-62718 · GHSA-3p68-rc4w-qgx5
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Priority HIGH 67
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-29551 CVE-2026-40895
follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets
Priority LOW 31
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
TI-2026-24811 CVE-2026-32282 · GHSA-xj38-jxc5-rppx
TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
Priority LOW 30
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.