TI-2026-30595 CVE-2026-42284 · GHSA-x2qx-6953-8485
GitPython: Unsafe option check validates multi_options before shlex.split transforms it
Priority HIGH 76
GitPython is a python library used to interact with Git repositories.
RHSA-2026:42079
Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Released 2026-07-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 ansible-core-2:2.16.19-1.el10ap, receptor-1.6.6-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, automation-controller-venv-tower-4.7.14-3.el9ap, automation-gateway-proxy-2.6.17-1.el9ap +5
Fixes 14 records
TI-2026-30536 CVE-2026-42215 · GHSA-rpm5-65cw-6hj4
GitPython: Command injection via Git options bypass
Priority HIGH 73
GitPython is a python library used to interact with Git repositories.
TI-2026-32221 CVE-2026-44244 · GHSA-v87r-6q3f-2j67
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
Priority HIGH 69
GitPython is a python library used to interact with Git repositories.
TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
TI-2026-10860 CVE-2026-12701 · GHSA-j5cg-p988-g42q
Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
Priority MEDIUM 41
A path traversal vulnerability was found in pulpcore.
TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Priority MEDIUM 40
urllib3 is an HTTP client library for Python.
TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478
Crash when handling long CNAME response in net
Priority MEDIUM 40
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
TI-2026-05545 CVE-2026-6321 · GHSA-q3j6-qgpj-74h6
fast-uri vulnerable to path traversal via percent-encoded dot segments
Priority MEDIUM 40
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.
TI-2026-24810 CVE-2026-32281 · GHSA-gjvh-7jh8-7xhm
Inefficient policy validation in crypto/x509
Priority LOW 39
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.
TI-2026-09781 CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj
Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution
Priority LOW 35
A flaw was found in ansible-core.
TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r
Inefficient candidate hostname parsing in crypto/x509
Priority LOW 30
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-07594 CVE-2026-8643 · GHSA-wf93-45jw-7689
pip can extract console_scripts and gui_scripts outside installation directory
Priority LOW 19
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…