TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw
node-tar: Decompression/parse DoS via unlimited input
Priority HIGH 79
node-tar is a tar archive manipulation library for Node.js.
RHSA-2026:83598
RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
Released 2026-10-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
Fixes 18 records
TI-2026-33367 CVE-2026-45623 · GHSA-6g55-p6wh-862q
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Priority HIGH 78
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2026-42688 CVE-2026-59874 · GHSA-8x88-c5mf-7j5w
node-tar: Negative tar entry size causes infinite loop in archive replace
Priority HIGH 77
node-tar is a tar archive manipulation library for Node.js.
TI-2026-51730 CVE-2026-73646 · GHSA-r28c-9q8g-f849
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Priority HIGH 72
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2026-51727 CVE-2026-73643 · GHSA-pm4m-ph32-ghv5
js-yaml: Exponential parsing time in the flow collections leads to denial of service
Priority HIGH 72
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-51295 CVE-2026-73088 · GHSA-73wf-gq98-2v4g
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
Priority HIGH 72
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
TI-2026-48533 CVE-2026-69153 · GHSA-fxqj-rqcc-2cmp
Information disclosure in postcss
Priority MEDIUM 61
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
TI-2026-63115 CVE-2026-93749 · GHSA-68fv-2mgg-jv7q
source-map-js through 1.2.1 Event Loop Denial of Service
Priority MEDIUM 44
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values.
TI-2026-51612 CVE-2026-73500 · GHSA-6vch-q96h-7gc3
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
Priority MEDIUM 44
etcd is a distributed key-value store for the data of a distributed system.
TI-2026-57986 CVE-2026-84375 · GHSA-2883-xcg3-v3hh
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
Priority MEDIUM 40
js-yaml is a JavaScript YAML parser and dumper.
TI-2026-51296 CVE-2026-73089 · GHSA-c83g-rgw3-j3cx
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
Priority MEDIUM 40
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools.
TI-2026-40994 CVE-2026-56854 · GHSA-gjhq-gjfw-99mq
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
Priority LOW 39
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595.
TI-2026-47530 CVE-2026-67214 · GHSA-28wg-ghj8-5hjv
nanoid Infinite Loop via Negative Size in non-secure module
Priority LOW 36
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure).
TI-2026-47529 CVE-2026-67213 · GHSA-2v37-7h3g-55p8
nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom
Priority LOW 36
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.
TI-2026-51293 CVE-2026-73086 · GHSA-xwg4-73v4-xw9w
nanoid: Integer Overflow or Wraparound
Priority LOW 34
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript.