TI-2026-23747 CVE-2026-30922 · GHSA-jr27-m4p2-rc6r
pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
RHSA-2026:6404
Red Hat Ansible Automation Platform 2.6 Container Release Update
Released 2026-04-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/hub-rhel9, registry.redhat.io/ansible-automation-platform-26/lightspeed-chatbot-rhel9 +2
Fixes 11 records
TI-2026-23656 CVE-2026-30827 · GHSA-46wh-pxpv-q5gq
Resource allocation without limits in express-rate-limit
Priority HIGH 72
express-rate-limit is a basic rate-limiting middleware for Express.
TI-2025-42946 CVE-2025-69873 · GHSA-2g4f-4pwh-qvx6
Regular expression denial of service in ajv.js ajv
Priority HIGH 72
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
TI-2026-22761 CVE-2026-28498 · GHSA-m344-f55w-2m6j
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Priority HIGH 69
Authlib is a Python library which builds OAuth and OpenID Connect servers.
TI-2026-01301 CVE-2026-1615 · GHSA-87r5-mp6g-5w5j
Code injection in jsonpath
Priority MEDIUM 50
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions.
TI-2026-21005 CVE-2026-25990 · GHSA-cfh3-3jmp-rvhc
Pillow has an out-of-bounds write when loading PSD images
Priority MEDIUM 45
Pillow is a Python imaging library.
TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433
Axios affected by Denial of Service via __proto__ Key in mergeConfig
Priority MEDIUM 44
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-23219 CVE-2026-29074 · GHSA-xpqw-6gx7-v673
SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
Priority MEDIUM 40
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
TI-2026-22996 CVE-2026-28802 · GHSA-7wc2-qxgw-g8gg
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
Priority MEDIUM 40
Authlib is a Python library which builds OAuth and OpenID Connect servers.
TI-2025-42677 CVE-2025-69223 · GHSA-6mq8-rvhq-8wgg
AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
Priority MEDIUM 40
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.
TI-2026-21021 CVE-2026-26007 · GHSA-r6ph-v2qm-q3c2
cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Priority LOW 36
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.