TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
RHSA-2026:59155
Red Hat Ansible Automation Platform 2.6 Container Release Update
Released 2026-08-24 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9 +5
Fixes 19 records
TI-2026-47621 CVE-2026-67325 · GHSA-2f96-g7mh-g2hx
GitPython before 3.1.51 Command Injection via option prefix abbreviation
Priority HIGH 73
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature.
TI-2026-48532 CVE-2026-69152 · GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Priority HIGH 72
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-32592 CVE-2026-44705 · GHSA-ph9p-34f9-6g65
tmp: Path Traversal via unsanitized prefix/postfix enables directory escape
Priority HIGH 69
tmp is a temporary file and directory creator for node.js.
TI-2025-38908 CVE-2025-62718 · GHSA-3p68-rc4w-qgx5
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Priority HIGH 67
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-01301 CVE-2026-1615 · GHSA-87r5-mp6g-5w5j
Code injection in jsonpath
Priority MEDIUM 50
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions.
TI-2026-12883 CVE-2026-15307 · GHSA-wvqv-fj8w-qmhm
Server-side file-write and request forgery via spatial lookups
Priority MEDIUM 42
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
TI-2026-12072 CVE-2026-14257 · GHSA-mh99-v99m-4gvg
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Priority MEDIUM 40
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.
TI-2025-42677 CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Priority MEDIUM 40
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-42700 CVE-2026-59886 · GHSA-hm4w-wwcw-mr6r
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Priority LOW 39
pyasn1 is a generic ASN.1 library for Python.
TI-2026-32457 CVE-2026-44545 · GHSA-rrc9-mx66-ffcm
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
Priority LOW 39
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory.
TI-2026-50011 CVE-2026-71364 · GHSA-6v7v-pp54-gr28
Awx: project archive extraction allows path traversal file writes
Priority LOW 37
A path traversal vulnerability was found in AWX's project archive extraction.
TI-2025-42682 CVE-2025-69228 · GHSA-6jhg-hg63-jvvf
AIOHTTP vulnerable to denial of service through large payloads
Priority LOW 35
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2025-42681 CVE-2025-69227 · GHSA-jj3x-wxrx-4x23
AIOHTTP vulnerable to DoS when bypassing asserts
Priority LOW 35
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-50013 CVE-2026-71366 · GHSA-8vqh-rjh4-52qh
Awx: notification backends allow ssrf and credential leakage
Priority LOW 34
A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends.
TI-2026-50012 CVE-2026-71365 · GHSA-89hq-rjv2-rxvp
Awx: webhook status callback ssrf leaks the git pat
Priority LOW 34
A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism.
TI-2026-48583 CVE-2026-69244 · GHSA-cq5v-8q36-5273
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
Priority LOW 32
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-08430 CVE-2026-9595 · GHSA-mx8g-39q3-5c79
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
Priority LOW 29
Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.
TI-2026-48582 CVE-2026-69243 · GHSA-mfx4-hv73-q22v
AIOHTTP: HTTP request smuggling via WebSocket upgrade
Priority LOW 28
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.