Trusted Profile Analyzer (Redhat) - vulnerabilities (CVEs)

37 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2026-09-16. Vendor: Redhat.

CVEs of Trusted Profile Analyzer

• CVE-2026-42784 - CVSS 7.4 (high), 2026-09-16: A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a…
• CVE-2026-12143 - CVSS 8.7 (high), 2026-06-12: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the…
• CVE-2026-44495 - CVSS 7.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in…
• CVE-2026-44494 - CVSS 8.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution…
• CVE-2026-44492 - CVSS 8.6 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When…
• CVE-2026-44496 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a…
• CVE-2026-44488 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size…
• CVE-2026-44487 - CVSS 8.2 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization…
• CVE-2026-44486 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a…
• CVE-2026-42264 - CVSS 9.1 (critical), 2026-05-08: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL,…
• CVE-2026-7598 - CVSS 9.1 (critical), 2026-05-01: A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such…
• CVE-2026-42041 - CVSS 8.2 (high), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution…
• CVE-2026-42044 - CVSS 9.1 (critical), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution…
• CVE-2026-42043 - CVSS 10 (critical), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request…
• CVE-2026-42039 - CVSS 7.5 (high), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit,…
• CVE-2026-42033 - CVSS 7.4 (high), 2026-04-24: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency…
• CVE-2026-40895 - CVSS 7.5 (high), 2026-04-21: follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an…
• CVE-2026-40175 - CVSS 8.1 (high), 2026-04-10: Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in…
• CVE-2025-62718 - CVSS 9.9 (critical), 2026-04-09: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when…
• CVE-2026-4800 - CVSS 9.8 (critical), 2026-03-31: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both…
• CVE-2026-4926 - CVSS 7.5 (high), 2026-03-26: Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated…
• CVE-2026-33186 - CVSS 9.1 (critical), 2026-03-20: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the…
• CVE-2026-31812 - CVSS 8.7 (high), 2026-03-10: Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a…
• CVE-2026-3338 - CVSS 8.7 (high), 2026-03-02: Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with…
• CVE-2026-3336 - CVSS 8.7 (high), 2026-03-02: Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7…
• CVE-2026-3304 - CVSS 8.7 (high), 2026-02-27: Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of…
• CVE-2026-2359 - CVSS 8.7 (high), 2026-02-27: Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of…
• CVE-2026-25639 - CVSS 7.5 (high), 2026-02-09: Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a…
• CVE-2025-13465 - CVSS 8.2 (high), 2026-01-21: The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from…
• CVE-2025-61686 - CVSS 9.1 (critical), 2026-01-10: React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to…
• CVE-2025-8556 - CVSS 3.7 (low), 2025-08-06: A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order…
• CVE-2025-5791 - CVSS 7.1 (high), 2025-06-06: A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer…
• CVE-2025-4574 - CVSS 6.5 (medium), 2025-05-13: In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free…
• CVE-2025-4432 - CVSS 5.3 (medium), 2025-05-09: A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows an attacker to…
• CVE-2025-3416 - CVSS 3.7 (low), 2025-04-08: A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may…
• CVE-2024-11831 - CVSS 5.4 (medium), 2025-02-10: A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such…
• CVE-2024-3508 - CVSS 4.3 (medium), 2024-04-25: A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some…