Red Hat Security Advisory

RHSA-2026:2694

A Subscription Management tool for finding and reporting Red Hat product usage

Released 2026-02-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9

Fixes 10 records

TI-2026-19377 CVE-2026-24049 · GHSA-8rrh-rw8j-w5fx

wheel Allows Arbitrary File Permission Modification via Path Traversal

MEDIUM 64

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.0035 Published 2026-01-22 Partial fix · 0.46.2 CWE-22

TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433

Axios affected by Denial of Service via proto Key in mergeConfig

MEDIUM 44

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02759 Published 2026-02-09 Partial fix · 1.13.5, 0.30.3 CWE-754

TI-2026-01001 CVE-2026-1285 · GHSA-4rrr-2h4v-f3j9

Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

MEDIUM 41

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01112 Published 2026-02-03 Partial fix · 6.0.2, 5.2.11 +1 CWE-407

TI-2025-13292 CVE-2025-14550 · GHSA-33mw-q7rj-mjwj

Potential denial-of-service vulnerability via repeated headers when using ASGI

MEDIUM 41

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01112 Published 2026-02-03 Partial fix · 6.0.2, 5.2.11 +2 CWE-407

TI-2025-12309 CVE-2025-13465 · GHSA-xxjr-mmjv-4gpg

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

MEDIUM 40

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01823 Published 2026-01-21 Partial fix · 4.17.23, 4.18.0 CWE-1321

TI-2026-00932 CVE-2026-1207 · GHSA-mwm9-4648-f68q

Potential SQL injection via raster lookups on PostGIS

LOW 39

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.12819 Published 2026-02-03 Partial fix · 6.0.2, 5.2.11 +1 CWE-89

TI-2026-17723 CVE-2026-22029 · GHSA-2w69-qvjg-hvjx

React Router vulnerable to XSS via Open Redirects

LOW 38

React Router is a router for React.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00866 Published 2026-01-10 Partial fix · 7.12.0, 1.23.2 CWE-79

TI-2026-21021 CVE-2026-26007 · GHSA-r6ph-v2qm-q3c2

cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

LOW 36

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00384 Published 2026-02-10 Partial fix · 46.0.5 CWE-345

TI-2026-01025 CVE-2026-1312 · GHSA-6426-9fv3-65x8

Potential SQL injection via QuerySet.order_by and FilteredRelation

LOW 26

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00897 Published 2026-02-03 Partial fix · 6.0.2, 5.2.11 +1 CWE-89

TI-2026-01003 CVE-2026-1287 · GHSA-gvg8-93h5-g6qq

Potential SQL injection in column aliases via control characters

LOW 26

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00843 Published 2026-02-03 Partial fix · 6.0.2, 5.2.11 +1 CWE-89