TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf
Axios: Allocation of Resources Without Limits or Throttling in axios
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:34160
Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Released 2026-07-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.13-2.el9ap, automation-controller-cli-4.7.13-2.el9ap, automation-controller-server-4.7.13-2.el9ap +7
Fixes 11 records
TI-2026-25584 CVE-2026-33154 · GHSA-pxrr-hq57-q35p
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
Priority HIGH 70
dynaconf is a configuration management tool for Python.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-35886 CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Priority HIGH 68
PyJWT is a JSON Web Token implementation in Python.
TI-2026-30414 CVE-2026-42035 · GHSA-6chq-wfr3-2hj9
Axios: Header Injection via Prototype Pollution
Priority HIGH 68
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-29849 CVE-2026-41240 · GHSA-h7mw-gpvr-xq4m
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Priority MEDIUM 60
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.
TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Priority MEDIUM 40
urllib3 is an HTTP client library for Python.
TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.
TI-2026-32372 CVE-2026-44431 · GHSA-qccp-gfcp-xxvc
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Priority LOW 36
urllib3 is an HTTP client library for Python.
TI-2026-32264 CVE-2026-44293 · GHSA-66ff-xgx4-vchm
protobufjs: Code injection through bytes field defaults in generated toObject code
Priority LOW 36
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-31005 CVE-2026-42784 · GHSA-g33h-rrj9-75qv
Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
Priority LOW 32
A flaw was found in sequoia-openpgp.