TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv
Server-side request forgery in axios
Priority HIGH 76
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:30650
multicluster engine for Kubernetes v2.8.8 security update
Released 2026-06-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
Fixes 15 records
TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Priority HIGH 73
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf
Axios: Allocation of Resources Without Limits or Throttling in axios
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-34255 CVE-2026-46595 · GHSA-x527-x647-q7gg
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Priority MEDIUM 50
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
TI-2026-26126 CVE-2026-33747 · GHSA-4c29-8rgm-jvjj
BuildKit vulnerable to malicious frontend causing file escape outside of storage root
Priority MEDIUM 43
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8
Go JOSE affect by a panic in JWE decryption
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
TI-2026-26127 CVE-2026-33748 · GHSA-4vrq-3vrq-g6gg
BuildKit Git URL subdir component can cause access to restricted files
Priority LOW 36
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.
TI-2025-30318 CVE-2025-47914 · GHSA-f6x5-jh6r-wrfv
Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent
Priority LOW 31
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
TI-2026-27359 CVE-2026-35206 · GHSA-hr2v-4r36-88hr
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Priority LOW 21
Helm is a package manager for Charts for Kubernetes.
TI-2025-35990 CVE-2025-58183 · GHSA-9gcr-gp5f-jw27
Unbounded allocation when parsing GNU sparse map in archive/tar
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.