TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
RHSA-2026:54770
OpenShift Container Platform 4.22.10 bug fix and security update
Released 2026-08-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-image-registry-rhel9-operator +11
Fixes 9 records
TI-2026-28713 CVE-2026-39831 · GHSA-89gr-r52h-f8rx
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
Priority MEDIUM 48
The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag.
TI-2026-34256 CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
TI-2026-31149 CVE-2026-42965 · GHSA-76ww-43j5-78x5
Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation
Priority LOW 34
A flaw was found in the OpenShift Router.
TI-2026-36990 CVE-2026-50237 · GHSA-5mvj-m7fw-m49w
Server-side request forgery in Red Hat OpenShift Container Platform 4.12
Priority LOW 33
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy.
TI-2026-36989 CVE-2026-50236 · GHSA-c4v8-c9cj-xrmr
Server-side request forgery in Red Hat OpenShift Container Platform 4.14
Priority LOW 33
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers.
TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-28761 CVE-2026-39882 · GHSA-w8rr-5gcm-pp58
OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies
Priority LOW 23
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
TI-2026-12143 CVE-2026-14362 · GHSA-6r3r-6rpf-v429
Denial of service via crafted push/pull gossip message in memberlist
Priority LOW 22
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node…