TI-2026-34099 CVE-2026-46385 · GHSA-w8j3-pq8g-8m7w
iskorotkov/avro: CPU Exhaustion in Avro Decoder
Priority HIGH 77
iskorotkov/avro is a fast Go Avro codec.
RHSA-2026:30651
Red Hat Advanced Cluster Management for Kubernetes v2.13.9 security update
Released 2026-06-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +18
Fixes 14 records
TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv
Server-side request forgery in axios
Priority HIGH 76
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Priority HIGH 73
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf
Axios: Allocation of Resources Without Limits or Throttling in axios
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-34255 CVE-2026-46595 · GHSA-x527-x647-q7gg
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
Priority MEDIUM 50
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
TI-2026-34098 CVE-2026-46384 · GHSA-mc57-h6j3-3hmv
iskorotkov/avro: Integer Overflow in Avro Decoder
Priority MEDIUM 44
iskorotkov/avro is a fast Go Avro codec.
TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
Priority MEDIUM 40
Prometheus is an open-source monitoring system and time series database.
TI-2026-31933 CVE-2026-43869 · GHSA-7pwc-h2j2-rjgj
Apache Thrift: TSSLTransportFactory.java hostname verification
Priority LOW 39
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
TI-2026-27359 CVE-2026-35206 · GHSA-hr2v-4r36-88hr
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Priority LOW 21
Helm is a package manager for Charts for Kubernetes.