TI-2026-32490 CVE-2026-44578 · GHSA-c4j6-fc7j-m34r
Next.js: Server-side request forgery in applications using WebSocket upgrades
Priority HIGH 69
Next.js is a React framework for building full-stack web applications.
RHSA-2026:40974
RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
Released 2026-07-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
Fixes 15 records
TI-2026-28713 CVE-2026-39831 · GHSA-89gr-r52h-f8rx
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
Priority MEDIUM 48
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.
TI-2026-28712 CVE-2026-39830 · GHSA-vgwf-h737-ff37
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
Priority MEDIUM 46
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
TI-2026-32487 CVE-2026-44575 · GHSA-267c-6grr-h53f
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Priority MEDIUM 42
Next.js is a React framework for building full-stack web applications.
TI-2026-32946 CVE-2026-45109 · GHSA-26hh-7cqf-hhc6
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
Priority MEDIUM 40
Next.js is a React framework for building full-stack web applications.
TI-2026-32491 CVE-2026-44579 · GHSA-mg66-mrh9-m8jx
Next.js: Denial of Service via connection exhaustion in applications using Cache Components
Priority MEDIUM 40
Next.js is a React framework for building full-stack web applications.
TI-2026-32485 CVE-2026-44573 · GHSA-36qx-fr4f-26g5
Next.js: Middleware / Proxy bypass in Pages Router applications using i18n
Priority MEDIUM 40
Next.js is a React framework for building full-stack web applications.
TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
Priority MEDIUM 40
Prometheus is an open-source monitoring system and time series database.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-30481 CVE-2026-42151 · GHSA-wg65-39gg-5wfj
Prometheus Azure AD remote write OAuth client secret exposed via config API
Priority LOW 39
Prometheus is an open-source monitoring system and time series database.
TI-2026-28711 CVE-2026-39829 · GHSA-w879-237q-wc7r
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.
TI-2026-32486 CVE-2026-44574 · GHSA-492v-c6pp-mqqv
Next.js: Middleware / Proxy bypass through dynamic route parameter injection
Priority LOW 38
Next.js is a React framework for building full-stack web applications.
TI-2026-32489 CVE-2026-44577 · GHSA-h64f-5h5j-jqjh
Next.js: Denial of Service in the Image Optimization API
Priority LOW 28
Next.js is a React framework for building full-stack web applications.
TI-2026-28710 CVE-2026-39828 · GHSA-45gg-vh54-h5m9
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
Priority LOW 28
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…
TI-2026-28717 CVE-2026-39835 · GHSA-78mq-xcr3-xm33
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
Priority LOW 25
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.