TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw
Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Priority HIGH 69
Axios is a promise based HTTP client for the browser and Node.js.
Vulnerabilities
29 records
TI-2026-34281 CVE-2026-46625 · GHSA-qjx8-664m-686j
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
Priority HIGH 72
JavaScript Cookie is a JavaScript API for handling cookies, client-side.
TI-2026-35991 CVE-2026-48710 · GHSA-86qp-5c8j-p5mr
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Priority CRITICAL 86KEV
Starlette is a lightweight ASGI framework/toolkit.
TI-2026-28834 CVE-2026-39979
jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers
Priority HIGH 70
jq is a command-line JSON processor.
TI-2025-35716 CVE-2025-57847 · GHSA-49g2-wpmf-55pv
Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions
Priority LOW 30
A container privilege escalation flaw was found in certain Ansible Automation Platform images.
TI-2026-23208 CVE-2026-29063 · GHSA-wf6x-7x77-mvgw
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
TI-2025-09094 CVE-2025-9909 · GHSA-2fx4-vwf2-pw99
Aap-gateway: improper path validation in gateway allows credential exfiltration
Priority LOW 31
A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component.
TI-2025-09093 CVE-2025-9908 · GHSA-c2g3-cfch-p5h4
Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams
Priority LOW 31
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams.
TI-2025-09092 CVE-2025-9907 · GHSA-3mcc-r9wq-f9g6
Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda
Priority LOW 31
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API.
TI-2025-33747 CVE-2025-53861 · GHSA-3f47-vg2x-225m
Aap: sensitive cookie(s) set without security flags
Priority LOW 14
A flaw was found in Ansible.
TI-2025-33748 CVE-2025-53862 · GHSA-qm85-96h4-7f94
Aap: aap-gateway: automation-hub: sensitive information disclosure
Priority LOW 16
A flaw was found in Ansible.
TI-2024-09312 CVE-2024-10033 · GHSA-h596-hg59-cxrq
Aap-gateway: xss on aap-gateway
Priority LOW 27
A vulnerability was found in aap-gateway.
TI-2024-00636 CVE-2024-0690 · GHSA-h24r-m9qc-pvpg
Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
Priority LOW 25
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios.
TI-2023-27712 CVE-2023-50782 · GHSA-3ww4-gg4f-jr7f
Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659
Priority HIGH 66
A flaw was found in the python-cryptography package.
TI-2023-04704 CVE-2023-5115 · GHSA-jpvw-p8pr-9g2x
Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files
Priority LOW 30
An absolute path traversal attack exists in the Ansible automation platform.
TI-2023-05302 CVE-2023-5764 · GHSA-7j69-qfc3-2fq9
Ansible: template injection
Priority LOW 37
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data.
TI-2023-04777 CVE-2023-5189 · GHSA-55g2-vm3q-7w52
Hub: insecure galaxy-importer tarfile extraction
Priority LOW 31
A path traversal vulnerability exists in Ansible when extracting tarballs.
TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3
The HTTP/2 protocol allows a denial of service (server resource consumption) because…
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
TI-2023-03687 CVE-2023-3971 · GHSA-p5xq-xr8f-3wj4
Controller: html injection in custom login info
Priority LOW 34
An HTML injection flaw was found in Controller in the user interface settings.
TI-2023-04046 CVE-2023-4380 · GHSA-2pfv-q6j2-pcrf
Platform: token exposed at importing project
Priority LOW 29
A logic flaw exists in Ansible Automation platform.
TI-2023-03924 CVE-2023-4237 · GHSA-ww3m-ffrm-qvqv
Platform: ec2_key module prints out the private key directly to the standard output
Priority LOW 34
A flaw was found in the Ansible Automation Platform.
TI-2022-03352 CVE-2022-3644 · GHSA-qv37-mfjf-42h8
Insufficiently protected credentials in pulp_ansible
Priority MEDIUM 58
The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
TI-2022-02960 CVE-2022-3205 · GHSA-24jx-rfj6-x4mp
Controller: cross site scripting in automation controller ui
Priority LOW 28
Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS injection
TI-2022-01502 CVE-2022-1632 · GHSA-x47w-fx67-qh3w
Improper certificate validation in Openshift
Priority LOW 29
An Improper Certificate Validation attack was found in Openshift.
TI-2021-02990 CVE-2021-4112 · GHSA-2q78-vv73-5vr2
A flaw was found in ansible-tower where the default installation is vulnerable to job…
Priority LOW 38
A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape.