TI-2026-35991 CVE-2026-48710 · GHSA-86qp-5c8j-p5mr
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Priority CRITICAL 86KEV
Starlette is a lightweight ASGI framework/toolkit.
RHSA-2026:63337
satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
Released 2026-09-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
Fixes 6 records
TI-2026-47618 CVE-2026-67322 · GHSA-rwj8-pgh3-r573
GitPython before 3.1.52 Environment Variable Exfiltration via clone_from
Priority HIGH 77
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from().
TI-2026-47621 CVE-2026-67325 · GHSA-2f96-g7mh-g2hx
GitPython before 3.1.51 Command Injection via option prefix abbreviation
Priority HIGH 73
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature.
TI-2026-47619 CVE-2026-67323 · GHSA-956x-8gvw-wg5v
GitPython before 3.1.51 Command Injection via unguarded Git options
Priority HIGH 72
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbi…
TI-2026-48583 CVE-2026-69244 · GHSA-cq5v-8q36-5273
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
Priority LOW 32
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-48582 CVE-2026-69243 · GHSA-mfx4-hv73-q22v
AIOHTTP: HTTP request smuggling via WebSocket upgrade
Priority LOW 28
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.