TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:47949
multicluster engine for Kubernetes v2.6.13 security update
Released 2026-07-29 · Red Hat rating Critical · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +2
Fixes 6 records
TI-2026-13581 CVE-2026-16242 · GHSA-43hh-68v6-mf36
Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates
Priority MEDIUM 50
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes.
TI-2026-14230 CVE-2026-17107 · GHSA-vr7g-637m-v9mm
Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster
Priority MEDIUM 40
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE).
TI-2026-28711 CVE-2026-39829 · GHSA-w879-237q-wc7r
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-28717 CVE-2026-39835 · GHSA-78mq-xcr3-xm33
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
Priority LOW 25
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.