TI-2026-01301 CVE-2026-1615 · GHSA-87r5-mp6g-5w5j
Code injection in jsonpath
Priority MEDIUM 50
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions.
RHSA-2026:6308
Red Hat Ansible Automation Platform 2.5 Container Release Update
Released 2026-03-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8
Fixes 5 records
TI-2026-21005 CVE-2026-25990 · GHSA-cfh3-3jmp-rvhc
Pillow has an out-of-bounds write when loading PSD images
Priority MEDIUM 45
Pillow is a Python imaging library.
TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433
Axios affected by Denial of Service via __proto__ Key in mergeConfig
Priority MEDIUM 44
Axios is a promise based HTTP client for the browser and Node.js.
TI-2025-42677 CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Priority MEDIUM 40
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-21021 CVE-2026-26007 · GHSA-r6ph-v2qm-q3c2
cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Priority LOW 36
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.