TI-2026-42701 CVE-2026-59887 · GHSA-v245-v573-v5vm
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
Priority HIGH 72
linkify-it is a links recognition library with full Unicode support.
RHSA-2026:83662
MTV RHEL9 Images
Released 2026-10-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Migration Toolkit for Virtualization 2.11 registry.redhat.io/migration-toolkit-virtualization/mtv-api-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9, registry.redhat.io/migration-toolkit-virtualization/mtv-validation-rhel9 +1
Fixes 5 records
TI-2026-36926 CVE-2026-50162 · GHSA-8xwf-rjm4-xvhv
oras-go: file store write outside workingDir via symlink traversal
Priority HIGH 70
oras-go is a Go library for managing OCI artifacts.
TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r
Infinite loop on invalid input in golang.org/x/text
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
TI-2026-60056 CVE-2026-88031 · GHSA-gf3f-xg7m-h8wp
GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
Priority LOW 28
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a…