TI-2026-34099 CVE-2026-46385 · GHSA-w8j3-pq8g-8m7w
iskorotkov/avro: CPU Exhaustion in Avro Decoder
Priority HIGH 77
iskorotkov/avro is a fast Go Avro codec.
RHSA-2026:44622
Multicluster Global Hub 1.6.4 security update
Released 2026-07-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Multicluster Global Hub 1.6.6 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +1
Fixes 16 records
TI-2026-40198 CVE-2026-55677 · GHSA-vfp3-v2gw-7wfq
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Priority HIGH 72
Echo is a Go web framework.
TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
TI-2026-34098 CVE-2026-46384 · GHSA-mc57-h6j3-3hmv
iskorotkov/avro: Integer Overflow in Avro Decoder
Priority MEDIUM 44
iskorotkov/avro is a fast Go Avro codec.
TI-2026-38567 CVE-2026-53488 · GHSA-xhf5-7wjv-pqxp
Improper input validation in backstage containerd
Priority MEDIUM 42
containerd is an open-source container runtime.
TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm
Prometheus: remote read endpoint allows denial of service via crafted snappy payload
Priority MEDIUM 40
Prometheus is an open-source monitoring system and time series database.
TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478
Crash when handling long CNAME response in net
Priority MEDIUM 40
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
TI-2026-30481 CVE-2026-42151 · GHSA-wg65-39gg-5wfj
Prometheus Azure AD remote write OAuth client secret exposed via config API
Priority LOW 39
Prometheus is an open-source monitoring system and time series database.
TI-2026-31934 CVE-2026-43870 · GHSA-526f-jxpj-jmg2
Apache Thrift: Node.js web_server.js multi-vulnerability
Priority LOW 38
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resourc…
TI-2026-38569 CVE-2026-53492 · GHSA-33vj-92qq-66hc
containerd CRI checkpoint restore CDI annotation smuggling
Priority LOW 36
containerd is an open-source container runtime.
TI-2026-25775 CVE-2026-33376 · GHSA-3r2p-7499-27q3
Auth Proxy IPv6 whitelist bypass
Priority LOW 34
When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses.
TI-2026-30122 CVE-2026-41567 · GHSA-x86f-5xw2-fm2r
Docker: `PUT /containers/{id}/archive` executes container binary on the host
Priority LOW 33
Moby is an open source container framework.
TI-2026-25776 CVE-2026-33377 · GHSA-5cv7-h7gr-wjgh
Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin
Priority LOW 33
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.
TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r
Inefficient candidate hostname parsing in crypto/x509
Priority LOW 30
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.