TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
RHSA-2026:48891
RHACS 4.11.2 security and bug fix update
Released 2026-07-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9
Fixes 5 records
TI-2026-36811 CVE-2026-49978 · GHSA-rp9w-3fw7-7cwq
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
Priority MEDIUM 61
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.
TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9
Quadratic complexity in WordDecoder.DecodeHeader in mime
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp
Uncontrolled resource consumption in juliangruber brace-expansion
Priority MEDIUM 40
brace-expansion through 5.0.6 is vulnerable to denial of service.
TI-2026-28704 CVE-2026-39822 · GHSA-xcgv-8mv7-v8c7
Root escape via symlink plus trailing slash in os
Priority LOW 36
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.