TI-2026-36017 CVE-2026-48746 · GHSA-94f4-hr76-p5j6
vLLM: OpenAI auth bypass
Priority HIGH 78
vLLM is an inference and serving engine for large language models (LLMs).
RHSA-2026:42132
Red Hat Ansible Automation Platform 2.6 Container Release Update
Released 2026-07-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
Fixes 16 records
TI-2026-30595 CVE-2026-42284 · GHSA-x2qx-6953-8485
GitPython: Unsafe option check validates multi_options before shlex.split transforms it
Priority HIGH 76
GitPython is a python library used to interact with Git repositories.
TI-2026-30536 CVE-2026-42215 · GHSA-rpm5-65cw-6hj4
GitPython: Command injection via Git options bypass
Priority HIGH 73
GitPython is a python library used to interact with Git repositories.
TI-2026-32221 CVE-2026-44244 · GHSA-v87r-6q3f-2j67
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
Priority HIGH 69
GitPython is a python library used to interact with Git repositories.
TI-2026-35886 CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Priority HIGH 68
PyJWT is a JSON Web Token implementation in Python.
TI-2026-28360 CVE-2026-39373 · GHSA-fjrm-76x2-c4q4
JWCrypto: JWE ZIP decompression bomb
Priority MEDIUM 63
JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.
TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
TI-2026-10860 CVE-2026-12701 · GHSA-j5cg-p988-g42q
Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport
Priority MEDIUM 41
A path traversal vulnerability was found in pulpcore.
TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Priority MEDIUM 40
urllib3 is an HTTP client library for Python.
TI-2026-30841 CVE-2026-42561 · GHSA-pp6c-gr5w-3c5g
Python-Multipart: Denial of Service via unbounded multipart part headers
Priority MEDIUM 40
Python-Multipart is a streaming multipart parser for Python.
TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478
Crash when handling long CNAME response in net
Priority MEDIUM 40
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
TI-2026-39183 CVE-2026-54283 · GHSA-82w8-qh3p-5jfq
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Priority LOW 39
Starlette is a lightweight ASGI framework/toolkit.
TI-2026-32372 CVE-2026-44431 · GHSA-qccp-gfcp-xxvc
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Priority LOW 36
urllib3 is an HTTP client library for Python.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-07594 CVE-2026-8643 · GHSA-wf93-45jw-7689
pip can extract console_scripts and gui_scripts outside installation directory
Priority LOW 19
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…