TI-2026-21992 CVE-2026-27606 · GHSA-mw96-cpmx-2vgc
Rollup 4 has Arbitrary File Write via Path Traversal
Priority HIGH 79
Rollup is a module bundler for JavaScript.
RHSA-2026:6802
Red Hat Developer Hub 1.9.3 release.
Released 2026-04-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
Fixes 15 records
TI-2026-20935 CVE-2026-25896 · GHSA-m7jm-9gc2-mpf2
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
Priority HIGH 79
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
TI-2025-42946 CVE-2025-69873 · GHSA-2g4f-4pwh-qvx6
Regular expression denial of service in ajv.js ajv
Priority HIGH 72
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.
TI-2026-01301 CVE-2026-1615 · GHSA-87r5-mp6g-5w5j
Code injection in jsonpath
Priority MEDIUM 50
Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection via unsafe evaluation of user-supplied JSON Path expressions.
TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
TI-2025-37931 CVE-2025-61140 · GHSA-6c59-mwgh-r2x6
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.
Priority MEDIUM 49
The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.
TI-2026-03033 CVE-2026-3520 · GHSA-5528-5vmv-3xc2
Multer vulnerable to Denial of Service via uncontrolled recursion
Priority MEDIUM 45
Multer is a node.js middleware for handling `multipart/form-data`.
TI-2026-02853 CVE-2026-3304 · GHSA-xf7r-hgr6-v32p
Multer vulnerable to Denial of Service via incomplete cleanup
Priority MEDIUM 45
Multer is a node.js middleware for handling `multipart/form-data`.
TI-2026-01995 CVE-2026-2359 · GHSA-v52c-386h-88mc
Multer vulnerable to Denial of Service via resource exhaustion
Priority MEDIUM 45
Multer is a node.js middleware for handling `multipart/form-data`.
TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433
Axios affected by Denial of Service via __proto__ Key in mergeConfig
Priority MEDIUM 44
Axios is a promise based HTTP client for the browser and Node.js.
TI-2026-21247 CVE-2026-26278 · GHSA-jmr7-xgp7-cmfj
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
Priority MEDIUM 41
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.
TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
TI-2026-20315 CVE-2026-25153 · GHSA-6jr7-99pf-8vgf
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
Priority LOW 39
Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs.
TI-2026-19374 CVE-2026-24046 · GHSA-rq6q-wr2q-7pgp
Backstage has a Possible Symlink Path Traversal in Scaffolder Actions
Priority LOW 32
Backstage is an open framework for building developer portals.
TI-2026-22286 CVE-2026-27942 · GHSA-fj3w-jwp8-x2g3
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
Priority LOW 14
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback.