TI-2026-36071 CVE-2026-48801 · GHSA-22p9-wv53-3rq4
linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop
Priority HIGH 77
linkify-it is a links recognition library with full Unicode support.
RHSA-2026:51038
OpenShift Container Platform 4.22.9 bug fix and security update
Released 2026-08-11 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hyperkube-rhel9 +4
Fixes 9 records
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-31183 CVE-2026-43003 · GHSA-rmxr-45gj-889w
OS command injection in OpenStack ironic-python-agent
Priority LOW 39
An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0.
TI-2026-36513 CVE-2026-49332 · GHSA-f2m2-cc3f-h4j2
Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables…
Priority LOW 37
A flaw was found in openshift/oauth-proxy.
TI-2026-08430 CVE-2026-9595 · GHSA-mx8g-39q3-5c79
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Priority LOW 29
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.
TI-2026-28710 CVE-2026-39828 · GHSA-45gg-vh54-h5m9
Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
Priority LOW 28
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-32788 CVE-2026-44918 · GHSA-q458-5jc4-vvpg
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
Priority LOW 25
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
TI-2026-28717 CVE-2026-39835 · GHSA-78mq-xcr3-xm33
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
Priority LOW 25
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.