TI-2026-29851 CVE-2026-41242 · GHSA-xq3m-2v4x-88gg
protobufjs has an arbitrary code execution issue
Priority HIGH 82
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
RHSA-2026:26234
Red Hat Developer Hub 1.9.5 release.
Released 2026-06-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
Fixes 10 records
TI-2026-19982 CVE-2026-24781 · GHSA-v37h-5mfm-c47c
vm2: Sandbox Breakout Through Inspect
Priority HIGH 82
vm2 is an open source vm/sandbox for Node.js.
TI-2026-30192 CVE-2026-41675 · GHSA-x6wf-f3px-wcqx
xmldom: XML node injection through unvalidated processing instruction serialization
Priority HIGH 77
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.
TI-2026-30191 CVE-2026-41674 · GHSA-f6ww-3ggp-fr8h
xmldom: XML injection through unvalidated DocumentType serialization
Priority HIGH 77
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.
TI-2026-30190 CVE-2026-41673 · GHSA-2v35-w6hq-6mfw
xmldom: Denial of service via uncontrolled recursion in XML serialization
Priority HIGH 77
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.
TI-2026-30189 CVE-2026-41672 · GHSA-j759-j44w-7fr8
xmldom: XML node injection through unvalidated comment serialization
Priority HIGH 77
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.
TI-2026-05545 CVE-2026-6321 · GHSA-q3j6-qgpj-74h6
fast-uri vulnerable to path traversal via percent-encoded dot segments
Priority MEDIUM 40
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.
TI-2026-24810 CVE-2026-32281 · GHSA-gjvh-7jh8-7xhm
Inefficient policy validation in crypto/x509
Priority LOW 39
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.
TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.
TI-2026-32264 CVE-2026-44293 · GHSA-66ff-xgx4-vchm
protobufjs: Code injection through bytes field defaults in generated toObject code
Priority LOW 36
protobufjs compiles protobuf definitions into JavaScript (JS) functions.