TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf
Axios: Allocation of Resources Without Limits or Throttling in axios
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
RHSA-2026:34374
Red Hat Ansible Automation Platform 2.6 Container Release Update
Released 2026-07-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +5
Fixes 13 records
TI-2026-25584 CVE-2026-33154 · GHSA-pxrr-hq57-q35p
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
Priority HIGH 70
dynaconf is a configuration management tool for Python.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-35886 CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Priority HIGH 68
PyJWT is a JSON Web Token implementation in Python.
TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx
ws: Uninitialized memory disclosure
Priority HIGH 66
ws is an open source WebSocket client and server for Node.js.
TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g
ip-address: XSS in Address6 HTML-emitting methods
Priority MEDIUM 57
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Priority MEDIUM 40
urllib3 is an HTTP client library for Python.
TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.
TI-2026-32372 CVE-2026-44431 · GHSA-qccp-gfcp-xxvc
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Priority LOW 36
urllib3 is an HTTP client library for Python.
TI-2026-32264 CVE-2026-44293 · GHSA-66ff-xgx4-vchm
protobufjs: Code injection through bytes field defaults in generated toObject code
Priority LOW 36
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
TI-2026-32167 CVE-2026-44188 · GHSA-r7cm-w9ch-cf3g
Insufficient session expiration in Red Hat Ansible Automation Platform 2.6
Priority LOW 24
A flaw was found in Ansible Lightspeed.
TI-2026-07594 CVE-2026-8643 · GHSA-wf93-45jw-7689
pip can extract console_scripts and gui_scripts outside installation directory
Priority LOW 19
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…