TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
RHSA-2026:66003
Ansible automation portal Red Hat Enterprise Linux Images
Released 2026-09-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
Fixes 12 records
TI-2026-48541 CVE-2026-69192 · GHSA-mwp4-54f8-5fhr
Improper input validation in beaugunderson ip-address
Priority HIGH 75
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
TI-2026-51727 CVE-2026-73643 · GHSA-pm4m-ph32-ghv5
js-yaml: Exponential parsing time in the flow collections leads to denial of service
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-51656 CVE-2026-73566 · GHSA-r292-9mhp-454m
Uncontrolled resource consumption in isaacs node-tar
Priority HIGH 72
node-tar is a tar archive manipulation library for Node.js.
TI-2026-48532 CVE-2026-69152 · GHSA-rgw5-rvv9-x895
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Priority HIGH 72
The brace-expansion library generates arbitrary strings containing a common prefix and suffix.
TI-2026-47703 CVE-2026-67422 · GHSA-gm37-52c6-37mw
pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Priority HIGH 72
pymdown-extensions is a collection of extensions for the Python Markdown library.
TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m
js-yaml: YAML merge-key chains can force quadratic CPU consumption
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-39172 CVE-2026-54272 · GHSA-22jq-vg5j-6vgg
ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
Priority HIGH 70
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.
TI-2026-51659 CVE-2026-73569 · GHSA-8r6m-32jq-jx6q
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
Priority MEDIUM 44
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.
TI-2026-12883 CVE-2026-15307 · GHSA-wvqv-fj8w-qmhm
Server-side file-write and request forgery via spatial lookups
Priority MEDIUM 42
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
TI-2026-12072 CVE-2026-14257 · GHSA-mh99-v99m-4gvg
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Priority MEDIUM 40
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion.
TI-2026-04434 CVE-2026-5079 · GHSA-72gw-mp4g-v24j
multer vulnerable to Denial of Service via deeply nested field names
Priority LOW 39
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data.