TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:28571
Red Hat Quay 3.9.23
Released 2026-06-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
Fixes 6 records
TI-2026-35886 CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Priority HIGH 68
PyJWT is a JSON Web Token implementation in Python.
TI-2026-08887 CVE-2026-10143 · GHSA-2jcm-hq8r-84wx
kafka-python prior to 2.3.2 DoS via SCRAM Iteration Count in scram.py
Priority MEDIUM 44
kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively…
TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
Priority MEDIUM 43
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.
TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Priority MEDIUM 40
urllib3 is an HTTP client library for Python.
TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.