TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
RHSA-2026:59153
Red Hat Ansible Automation Platform 2.7 Container Release Update
Released 2026-08-24 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +3
Fixes 15 records
TI-2026-28350 CVE-2026-39363 · GHSA-p9ff-h696-f583
Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
Priority HIGH 75
Vite is a frontend tooling framework for JavaScript.
TI-2026-34281 CVE-2026-46625 · GHSA-qjx8-664m-686j
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
Priority HIGH 72
JavaScript Cookie is a JavaScript API for handling cookies, client-side.
TI-2026-32592 CVE-2026-44705 · GHSA-ph9p-34f9-6g65
tmp: Path Traversal via unsanitized prefix/postfix enables directory escape
Priority HIGH 69
tmp is a temporary file and directory creator for node.js.
TI-2026-32221 CVE-2026-44244 · GHSA-v87r-6q3f-2j67
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
Priority HIGH 69
GitPython is a python library used to interact with Git repositories.
TI-2026-12883 CVE-2026-15307 · GHSA-wvqv-fj8w-qmhm
Server-side file-write and request forgery via spatial lookups
Priority MEDIUM 42
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
TI-2026-42700 CVE-2026-59886 · GHSA-hm4w-wwcw-mr6r
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Priority LOW 39
pyasn1 is a generic ASN.1 library for Python.
TI-2026-32457 CVE-2026-44545 · GHSA-rrc9-mx66-ffcm
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
Priority LOW 39
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory.
TI-2026-50011 CVE-2026-71364 · GHSA-6v7v-pp54-gr28
Awx: project archive extraction allows path traversal file writes
Priority LOW 37
A path traversal vulnerability was found in AWX's project archive extraction.
TI-2026-21866 CVE-2026-27459 · GHSA-5pwr-322w-8jr4
pyOpenSSL DTLS cookie callback buffer overflow
Priority LOW 35
pyOpenSSL is a Python wrapper around the OpenSSL library.
TI-2026-50013 CVE-2026-71366 · GHSA-8vqh-rjh4-52qh
Awx: notification backends allow ssrf and credential leakage
Priority LOW 34
A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends.
TI-2026-50012 CVE-2026-71365 · GHSA-89hq-rjv2-rxvp
Awx: webhook status callback ssrf leaks the git pat
Priority LOW 34
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism.
TI-2026-48583 CVE-2026-69244 · GHSA-cq5v-8q36-5273
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
Priority LOW 32
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-08430 CVE-2026-9595 · GHSA-mx8g-39q3-5c79
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Priority LOW 29
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.
TI-2026-48582 CVE-2026-69243 · GHSA-mfx4-hv73-q22v
AIOHTTP: HTTP request smuggling via WebSocket upgrade
Priority LOW 28
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.