TI-2025-07108 CVE-2025-7783 · GHSA-fjxv-7rqg-78g4
Usage of unsafe random function in form-data for choosing boundary
Priority HIGH 76
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).
RHSA-2026:3406
New container image: rhceph-9.0
Released 2026-02-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
Fixes 14 records
TI-2025-05586 CVE-2025-6176 · GHSA-2qfp-q593-8484
Brotli decompression bomb DoS in scrapy/scrapy
Priority HIGH 72
Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation.
TI-2021-06054 CVE-2021-23358 · GHSA-cf4h-3jhx-xvhq
Arbitrary code injection in underscore
Priority HIGH 67
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument…
TI-2025-19705 CVE-2025-26791 · GHSA-vhxf-7vqr-mrjg
Cross-site scripting in cure53 DOMPurify
Priority MEDIUM 60
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
TI-2026-17326 CVE-2026-21441 · GHSA-38jv-5279-wg99
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
Priority MEDIUM 50
urllib3 is an HTTP client library for Python.
TI-2025-40854 CVE-2025-66418 · GHSA-gm62-xv2j-4w53
urllib3 allows an unbounded number of links in the decompression chain
Priority MEDIUM 46
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-40898 CVE-2025-66471 · GHSA-2xpw-w6gg-jr37
urllib3 Streaming API improperly handles highly compressed data
Priority MEDIUM 40
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-16740 CVE-2025-22868 · GHSA-6v2p-p543-phr9
Unexpected memory consumption during token parsing in golang.org/x/oauth2
Priority MEDIUM 40
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
TI-2025-32065 CVE-2025-50182 · GHSA-48p4-8xcf-vxj5
urllib3 does not control redirects in browsers and Node.js
Priority LOW 28
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-32064 CVE-2025-50181 · GHSA-pq67-6m6q-mj2v
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
Priority LOW 28
urllib3 is a user-friendly HTTP client library for Python.
TI-2025-12886 CVE-2025-14104 · GHSA-hrx4-rccm-xj6c
Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
Priority LOW 27
A flaw was found in util-linux.
TI-2024-36887 CVE-2024-55565 · GHSA-mwcw-c2x4-8c55
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.
Priority LOW 21
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.
TI-2024-30381 CVE-2024-45310 · GHSA-jfvp-7x6p-h2pv
runc can be confused to create empty files/directories on the host
Priority LOW 17
runc is a CLI tool for spawning and running containers according to the OCI specification.
TI-2024-34649 CVE-2024-51744 · GHSA-29wx-vh33-7x7r
Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt
Priority LOW 16
golang-jwt is a Go implementation of JSON Web Tokens.