TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv
Server-side request forgery in axios
Priority HIGH 76
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:28964
OpenShift Container Platform 4.15.66 bug fix and security update
Released 2026-07-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
Fixes 13 records
TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Priority HIGH 73
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf
Axios: Allocation of Resources Without Limits or Throttling in axios
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm
Unexpected session resumption in crypto/tls
Priority MEDIUM 51
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…
TI-2026-21593 CVE-2026-27143 · GHSA-cfp9-33rc-j74f
Missing bound checks can lead to memory corruption in safe Go in cmd/compile
Priority MEDIUM 50
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow.
TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2026-01466 CVE-2026-1784 · GHSA-qmrp-jx57-5mr7
Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection
Priority LOW 39
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy.
TI-2026-21594 CVE-2026-27144 · GHSA-cqrx-3m42-5p5w
Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
Priority LOW 31
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading…