TI-2026-22305 CVE-2026-27962 · GHSA-wvwj-cvrp-7pv5
Authlib JWS JWK Header Injection: Signature Verification Bypass
Priority HIGH 80
Authlib is a Python library which builds OAuth and OpenID Connect servers.
RHSA-2026:5665
Red Hat Quay 3.10.19
Released 2026-03-24 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
Fixes 12 records
TI-2026-21992 CVE-2026-27606 · GHSA-mw96-cpmx-2vgc
Rollup 4 has Arbitrary File Write via Path Traversal
Priority HIGH 79
Rollup is a module bundler for JavaScript.
TI-2026-22248 CVE-2026-27904 · GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
Priority HIGH 66
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm
Unexpected session resumption in crypto/tls
Priority MEDIUM 51
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…
TI-2026-21005 CVE-2026-25990 · GHSA-cfh3-3jmp-rvhc
Pillow has an out-of-bounds write when loading PSD images
Priority MEDIUM 45
Pillow is a Python imaging library.
TI-2026-21474 CVE-2026-26996 · GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
Priority MEDIUM 44
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.
TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433
Axios affected by Denial of Service via __proto__ Key in mergeConfig
Priority MEDIUM 44
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4
Memory exhaustion in query parameter parsing in net/url
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
TI-2026-22010 CVE-2026-27628 · GHSA-2rw7-x74f-jg35
pypdf has a possible infinite loop when loading circular /Prev entries in cross-reference streams
Priority MEDIUM 41
pypdf is a free and open-source pure-python PDF library.
TI-2026-22996 CVE-2026-28802 · GHSA-7wc2-qxgw-g8gg
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
Priority MEDIUM 40
Authlib is a Python library which builds OAuth and OpenID Connect servers.
TI-2026-21021 CVE-2026-26007 · GHSA-r6ph-v2qm-q3c2
cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Priority LOW 36
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
TI-2025-38130 CVE-2025-61728 · GHSA-g9q4-qjx4-2v7q
Excessive CPU consumption when building archive index in archive/zip
Priority LOW 30
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened.