TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx
ws: Uninitialized memory disclosure
Priority HIGH 66
ws is an open source WebSocket client and server for Node.js.
RHSA-2026:44235
OpenShift Container Platform 4.19.40 bug fix and security update
Released 2026-07-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +2
Fixes 5 records
TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
Priority MEDIUM 40
Prometheus is an open-source monitoring system and time series database.
TI-2026-29551 CVE-2026-40895
follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets
Priority LOW 31
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.