TI-2026-19377 CVE-2026-24049 · GHSA-8rrh-rw8j-w5fx
wheel Allows Arbitrary File Permission Modification via Path Traversal
Priority MEDIUM 64
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.
RHSA-2026:2681
Red Hat Quay 3.16.2
Released 2026-02-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
Fixes 13 records
TI-2024-30407 CVE-2024-45337 · GHSA-v778-237x-gjrc
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Priority MEDIUM 53
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.
TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
TI-2025-40854 CVE-2025-66418 · GHSA-gm62-xv2j-4w53
urllib3 allows an unbounded number of links in the decompression chain
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4
Memory exhaustion in query parameter parsing in net/url
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
TI-2024-22606 CVE-2024-34156 · GHSA-crqm-pwhx-j97f
Stack exhaustion in Decoder.Decode in encoding/gob
Priority MEDIUM 41
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.
TI-2025-40898 CVE-2025-66471 · GHSA-2xpw-w6gg-jr37
urllib3 Streaming API improperly handles highly compressed data
Priority MEDIUM 40
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-40515 CVE-2025-65945 · GHSA-869p-cjfg-cm3x
auth0/node-jws improper HMAC signature verification vulnerability
Priority LOW 38
auth0/node-jws is a JSON Web Signature implementation for Node.js.
TI-2025-22394 CVE-2025-31133 · GHSA-9493-h29p-rfm2
runc container escape via "masked path" abuse due to mount race conditions
Priority LOW 37
runc is a CLI tool for spawning and running containers according to the OCI specification.
TI-2025-32917 CVE-2025-52881 · GHSA-cgrx-mc8f-2prm
runc: LSM labels can be bypassed with malicious config using dummy procfs files
Priority LOW 35
runc is a CLI tool for spawning and running containers according to the OCI specification.
TI-2025-13959 CVE-2025-15284 · GHSA-6rw7-vpxm-498p
arrayLimit bypass in bracket notation allows DoS via memory exhaustion
Priority LOW 34
Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
TI-2025-38131 CVE-2025-61729 · GHSA-7c64-f9jr-v9h2
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
TI-2024-30408 CVE-2024-45338 · GHSA-w32m-9786-jp63
Non-linear parsing of case-insensitive content in golang.org/x/net/html
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.