TI-2021-06035 CVE-2021-23337 · GHSA-35jh-r3h4-6jhm
Command injection in Lodash
Priority MEDIUM 59
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
RHSA-2026:7329
A Subscription Management tool for finding and reporting Red Hat product usage
Released 2026-04-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
Fixes 9 records
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2026-03561 CVE-2026-4111 · GHSA-xrqh-48jh-pjv2
Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive
Priority MEDIUM 40
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path.
TI-2026-03926 CVE-2026-4519 · GHSA-rm92-fj5q-mpj5
webbrowser.open() allows leading dashes in URLs
Priority LOW 33
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.
TI-2025-13528 CVE-2025-14831 · GHSA-pm8w-jq9r-x5rp
Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification
Priority LOW 31
A flaw was found in GnuTLS.
TI-2025-14016 CVE-2025-15367 · GHSA-g82h-mgfp-jx8g
POP3 command injection in user-controlled commands
Priority LOW 29
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines.
TI-2025-14015 CVE-2025-15366 · GHSA-4c67-8q63-xrxq
IMAP command injection in user-controlled commands
Priority LOW 29
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines.
TI-2026-01014 CVE-2026-1299 · GHSA-jh94-8q48-f3m3
email BytesGenerator header injection due to unquoted newlines
Priority LOW 28
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
TI-2025-09008 CVE-2025-9820 · GHSA-337w-h8w7-m899
Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function
Priority LOW 18
A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization.