TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
RHSA-2026:48693
OpenShift Container Platform 4.22.8 bug fix and security update
Released 2026-08-04 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-installer-artifacts-rhel9 +2
Fixes 7 records
TI-2026-32217 CVE-2026-44240 · GHSA-rpmf-866q-6p89
Uncontrolled resource consumption in patrickjuchli basic-ftp
Priority HIGH 72
basic-ftp is an FTP client for Node.js.
TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx
ws: Uninitialized memory disclosure
Priority HIGH 66
ws is an open source WebSocket client and server for Node.js.
TI-2026-36811 CVE-2026-49978 · GHSA-rp9w-3fw7-7cwq
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
Priority MEDIUM 61
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.
TI-2026-13581 CVE-2026-16242 · GHSA-43hh-68v6-mf36
Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates
Priority MEDIUM 50
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-28711 CVE-2026-39829 · GHSA-w879-237q-wc7r
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.