TI-2026-34099 CVE-2026-46385 · GHSA-w8j3-pq8g-8m7w
iskorotkov/avro: CPU Exhaustion in Avro Decoder
Priority HIGH 77
iskorotkov/avro is a fast Go Avro codec.
RHSA-2026:41064
Red Hat Advanced Cluster Management for Kubernetes v2.11.10 security update
Released 2026-07-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9
Fixes 16 records
TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv
Server-side request forgery in axios
Priority HIGH 76
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32848 CVE-2026-44990 · GHSA-rpr9-rxv7-x643
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
Priority HIGH 75
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API.
TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh
Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
Priority HIGH 73
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf
Axios: Allocation of Resources Without Limits or Throttling in axios
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Priority HIGH 72
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-08513 CVE-2025-9288 · GHSA-95m3-7q98-8xr5
Missing type checks leading to hash rewind and passing on crafted data
Priority HIGH 72
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-30791 CVE-2026-42508 · GHSA-5cgq-3rg8-m6cv
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
Priority MEDIUM 57
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.
TI-2026-34098 CVE-2026-46384 · GHSA-mc57-h6j3-3hmv
iskorotkov/avro: Integer Overflow in Avro Decoder
Priority MEDIUM 44
iskorotkov/avro is a fast Go Avro codec.
TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433
Axios affected by Denial of Service via __proto__ Key in mergeConfig
Priority MEDIUM 44
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-12309 CVE-2025-13465 · GHSA-xxjr-mmjv-4gpg
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
TI-2026-17723 CVE-2026-22029 · GHSA-2w69-qvjg-hvjx
React Router vulnerable to XSS via Open Redirects
Priority LOW 38
React Router is a router for React.
TI-2026-17494 CVE-2026-21721 · GHSA-jgfq-mgxg-4qwm
Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
Priority LOW 38
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action.