Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority CRITICAL 86KEV
Starlette is a lightweight ASGI framework/toolkit.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.70288 · Published 2026-05-26 · Partial fix · 1.0.1 CWE-444
Priority HIGH 72
JavaScript Cookie is a JavaScript API for handling cookies, client-side.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00919 · Published 2026-06-10 · Partial fix · 3.0.7 CWE-1321
Priority HIGH 70
jq is a command-line JSON processor.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0056 · Published 2026-04-13 · Partial fix · 2f09060afab23fe9390cce7cb860b10416e1bf5f CWE-125
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.7· Network · No auth · No interaction · EPSS 0.00854 · Published 2026-06-11 · Partial fix · 1.15.2, 0.31.1 CWE-1321
Priority HIGH 66
A flaw was found in the python-cryptography package.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01118 · Published 2024-02-05 · Partial fix · 42.0.0 CWE-203
Priority MEDIUM 58
The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00302 · Published 2022-10-25 · Partial fix · 0.15.0 CWE-256
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-03-06 · Partial fix · 3.8.3, 4.3.7 +2 CWE-1321
Priority LOW 38
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape.
CVSS 3.1HIGH 8.8· Local · Low privileges · No interaction · EPSS 0.00248 · Published 2022-08-25 · Fixed CWE-552
Priority LOW 37
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00574 · Published 2023-12-12 · Partial fix · 1:2.15.8-1.el8ap, 1:2.15.8-1.el9ap +3 CWE-1336
Priority LOW 37
A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02043 · Published 2021-04-29 · Partial fix · 2.10.6rc1, 2.9.18rc1 +1 CWE-200
Priority LOW 34
A flaw was found in the Ansible Automation Platform.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00252 · Published 2023-10-04 · Fixed in 1.0.0-423, 1.0.0-424 CWE-497
Priority LOW 34
An HTML injection flaw was found in Controller in the user interface settings.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00816 · Published 2023-10-04 · Fixed in 4.3.11-1.el8ap, 4.3.11-1.el9ap +2 CWE-80
Priority LOW 33
A flaw was found in Ansible, where a user's controller is vulnerable to template injection.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00897 · Published 2021-09-22 · Partial fix · 2.9.23rc1, 2.10.11rc1 +1 CWE-20
Priority LOW 31
A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00184 · Published 2026-02-27 · Fixed in 3.1.1-1.el8ap, 25.12.0-1.el8ap +39 CWE-647
Priority LOW 31
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00219 · Published 2026-02-27 · Fixed in 3.1.1-1.el8ap, 25.12.0-1.el8ap +39 CWE-200
Priority LOW 31
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00184 · Published 2026-02-27 · Fixed in 3.1.1-1.el8ap, 25.12.0-1.el8ap +39 CWE-200
Priority LOW 31
A path traversal vulnerability exists in Ansible when extracting tarballs.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00982 · Published 2023-11-14 · Fixed in 0.4.18-1.el8ap, 0.4.18-1.el9ap +2 CWE-23
Priority LOW 31
A privilege escalation flaw was found in the Ansible Automation Platform.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00981 · Published 2022-08-18 · Fixed CWE-269
Priority LOW 30
A container privilege escalation flaw was found in certain Ansible Automation Platform images.
CVSS 3.1MEDIUM 6.4· Local · High privileges · No interaction · EPSS 0.00186 · Published 2026-04-08 · Partial fix · 1789001438, 1789023765 +12 CWE-276
Priority LOW 30
An absolute path traversal attack exists in the Ansible automation platform.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · User interaction · EPSS 0.01013 · Published 2023-12-18 · Partial fix · 2.14.11-1.el8ap, 2.14.11-1.el9ap +3 CWE-36
Priority LOW 29
A logic flaw exists in Ansible Automation platform.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00636 · Published 2023-10-04 · Fixed in 1.0.1-1.el8ap, 1.0.1-1.el9ap CWE-532
Priority LOW 29
An Improper Certificate Validation attack was found in Openshift.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00422 · Published 2022-09-01 · Will not fix CWE-295
Priority LOW 28
Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS injection
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00525 · Published 2022-09-13 · No fix listed CWE-79
Priority LOW 27
A vulnerability was found in aap-gateway.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00395 · Published 2024-10-16 · Fixed in 2.5.3, 2.5.3-1.el8ap +1 CWE-79
Load more
THREATIST.IORead the docs