Red Hat Security AdvisoryRHSA-2026:37272
RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
Released 2026-07-09 · Red Hat rating Important · View on Red Hat →
Fixes 16 records
Priority HIGH 77
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00729 · Published 2026-06-09 · Partial fix · 1.2.1, 2.0.2 CWE-835
Priority HIGH 72
ws is an open source WebSocket client and server for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01426 · Published 2026-06-16 · Partial fix · 5.2.5, 6.2.4 +2 CWE-400
Priority HIGH 69
Next.js is a React framework for building full-stack web applications.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.35539 · Published 2026-05-13 · Partial fix · 16.2.5, 15.5.16 CWE-918
Priority HIGH 66
ws is an open source WebSocket client and server for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00745 · Published 2026-05-15 · Partial fix · 8.20.1 CWE-908
Priority MEDIUM 46
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00683 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-119
Priority MEDIUM 42
Next.js is a React framework for building full-stack web applications.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01594 · Published 2026-05-13 · Partial fix · 16.2.5, 15.5.16 CWE-288
Priority MEDIUM 40
Next.js is a React framework for building full-stack web applications.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00854 · Published 2026-05-13 · Partial fix · 15.5.17, 16.2.6 +1 CWE-288
Priority MEDIUM 40
Next.js is a React framework for building full-stack web applications.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00746 · Published 2026-05-13 · Partial fix · 16.2.5, 15.5.16 CWE-770
Priority MEDIUM 40
Next.js is a React framework for building full-stack web applications.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00796 · Published 2026-05-13 · Partial fix · 15.5.16, 16.2.5 CWE-863
Priority LOW 39
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00397 · Published 2026-06-09 · Partial fix · 5.8.1 CWE-770
Priority LOW 39
Prometheus is an open-source monitoring system and time series database.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00352 · Published 2026-05-04 · Partial fix · 3.5.3, 3.11.3 +1 CWE-200
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-347
Priority LOW 38
Next.js is a React framework for building full-stack web applications.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00636 · Published 2026-05-13 · Partial fix · 15.5.16, 16.2.5 CWE-288
Priority LOW 28
Next.js is a React framework for building full-stack web applications.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00739 · Published 2026-05-13 · Partial fix · 15.5.16, 16.2.5 CWE-770
Priority LOW 28
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00369 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
Priority LOW 25
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00504 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
THREATIST.IORead the docs