Red Hat Security AdvisoryRHSA-2026:54760
A Subscription Management tool for finding and reporting Red Hat product usage
Released 2026-08-13 · Red Hat rating Important · View on Red Hat →
Fixes 18 records
Priority HIGH 72
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00658 · Published 2026-08-11 · Partial fix · 4.28.7 CWE-1321
Priority HIGH 72
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00647 · Published 2026-08-03 · Partial fix · 1.1.18, 2.1.4 +2 CWE-400
Priority HIGH 72
A double free issue has been identified in libarchive's RAR5 reader.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00792 · Published 2026-06-30 · Partial fix · 3.7.7-10.el10_2, 3.7.7-5.el10_0.1 +58 CWE-415
Priority MEDIUM 61
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00451 · Published 2026-08-03 · Partial fix · 8.5.19, 8.5.23 CWE-200
Priority MEDIUM 41
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.
CVSS 4.0HIGH 7.8· Network · No auth · No interaction · EPSS 0.0075 · Published 2026-06-23 · Partial fix · 3.10.21, 3.11.16 +4 CWE-22
Priority MEDIUM 41
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00971 · Published 2025-06-03 · Partial fix · 3.9.23, 3.10.18 +4 CWE-22
Priority MEDIUM 40
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00655 · Published 2026-08-11 · Partial fix · 4.28.7 CWE-770
Priority MEDIUM 40
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00643 · Published 2026-07-23 · Partial fix · 5.0.8, 3.0.3 +2 CWE-400
Priority MEDIUM 40
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00692 · Published 2026-06-29 · Partial fix · 4.0.1, 3.1.3 +1 CWE-436
Priority MEDIUM 40
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00454 · Published 2026-05-14 · Partial fix · 18.4, 17.10 +3 CWE-242
Priority LOW 34
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00296 · Published 2026-08-11 · Partial fix · 3.3.12, 5.1.11 CWE-190
Priority LOW 32
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
CVSS 4.0HIGH 7.1· Network · No auth · User interaction · EPSS 0.00528 · Published 2026-08-03 · Partial fix · 3.14.3 CWE-125
Priority LOW 31
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00179 · Published 2026-06-02 · Partial fix · 3.14.0 CWE-502
Priority LOW 29
Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
CVSS 3.1MEDIUM 6.7· Local · No auth · No interaction · EPSS 0.00182 · Published 2026-04-23 · Fixed in 1.10.4, 1.11.3 +1 CWE-787
Priority LOW 29
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00163 · Published 2026-06-15 · Partial fix · 5.2.5 CWE-346
Priority LOW 28
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00443 · Published 2026-08-03 · Partial fix · 3.14.2 CWE-444
Priority LOW 27
A flaw was found in p11-kit.
CVSS 3.1MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00154 · Published 2026-06-29 · Partial fix · 0.26.4-1.el10_2, 0.26.4-1.el9_8 +32 CWE-674
Priority LOW 19
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…
CVSS 4.0MEDIUM 4.1· Local · Low privileges · User interaction · EPSS 0.0032 · Published 2026-06-01 · Partial fix · 26.1.2 CWE-22
THREATIST.IORead the docs