TI-2026-42693 CVE-2026-59879 · GHSA-v56q-mh7h-f735
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
Priority HIGH 77
Immutable.js provides many Persistent Immutable data structures.
RHSA-2026:85846
Migration Toolkit for Containers (MTC) 1.8.18 security and bug fix update
Released 2026-10-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8 +1
Fixes 9 records
TI-2026-48533 CVE-2026-69153 · GHSA-fxqj-rqcc-2cmp
Information disclosure in postcss
Priority MEDIUM 61
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3
gRPC-Go has an authorization bypass via missing leading slash in :path
Priority MEDIUM 49
gRPC-Go is the Go language implementation of gRPC.
TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
TI-2026-63115 CVE-2026-93749 · GHSA-68fv-2mgg-jv7q
source-map-js through 1.2.1 Event Loop Denial of Service
Priority MEDIUM 44
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values.
TI-2026-62455 CVE-2026-92599 · GHSA-mrx9-2rrp-rhpx
Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
Priority MEDIUM 44
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule.
TI-2026-61668 CVE-2026-90711 · GHSA-jqcg-44mw-7w3h
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
Priority MEDIUM 41
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips.
TI-2026-59907 CVE-2026-87776 · GHSA-vc2v-76pw-4v95
compression vulnerable to Denial of Service via memory leak on premature response close
Priority LOW 39
compression is a Node.js and Express compression middleware.
TI-2026-60056 CVE-2026-88031 · GHSA-gf3f-xg7m-h8wp
GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
Priority LOW 28
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than a…