TI-2026-30309 CVE-2026-41907 · GHSA-w5hq-g745-h8pq
uuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided
Priority HIGH 76
uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs.
RHSA-2026:56928
Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update
Released 2026-08-19 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25
Fixes 14 records
TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx
ws: Uninitialized memory disclosure
Priority HIGH 66
ws is an open source WebSocket client and server for Node.js.
TI-2026-32565 CVE-2026-44665 · GHSA-5wm8-gmm8-39j9
fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes
Priority MEDIUM 60
fast-xml-builder builds XML from JSON.
TI-2026-30169 CVE-2026-41650 · GHSA-gh4j-gqv2-49f6
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
Priority MEDIUM 60
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.
TI-2026-29908 CVE-2026-41305 · GHSA-qx2v-qp2m-jg93
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
Priority MEDIUM 60
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g
ip-address: XSS in Address6 HTML-emitting methods
Priority MEDIUM 57
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
TI-2026-08208 CVE-2026-9358 · GHSA-w9m9-85wc-3x92
postcss-selector-parser AST Serialization container.js toString recursion
Priority MEDIUM 57
A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2.
TI-2026-05545 CVE-2026-6321 · GHSA-q3j6-qgpj-74h6
fast-uri vulnerable to path traversal via percent-encoded dot segments
Priority MEDIUM 40
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions.
TI-2026-26051 CVE-2026-33671 · GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers
Priority LOW 39
Picomatch is a glob matcher written JavaScript.
TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.
TI-2026-28995 CVE-2026-40181 · GHSA-2j2x-hqr9-3h42
Open redirect in remix-run react-router
Priority LOW 35
React Router is a router for React.
TI-2026-32977 CVE-2026-45149 · GHSA-jxxr-4gwj-5jf2
brace-expansion: Large numeric range defeats documented `max` DoS protection
Priority LOW 33
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-26129 CVE-2026-33750 · GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
Priority LOW 33
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-26052 CVE-2026-33672 · GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
Priority LOW 30
Picomatch is a glob matcher written JavaScript.