RHSA-2026:2737

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation.

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument…

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

urllib3 is a user-friendly HTTP client library for Python.

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence…

urllib3 is a user-friendly HTTP client library for Python.

SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

Storybook is a frontend workshop for building user interface components and pages in isolation.

taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB.

In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases.

Cancelling a query (e.g.

A flaw was found in util-linux.

nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.

golang-jwt is a Go implementation of JSON Web Tokens.