Latest high severity vulnerabilities for "ibm agentics"

go/golang.org/x/crypto/sshInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Risk 47

Severity

7.5

First published (updated )

CVE-2026-39829

Microsoft azl3 kubevirt 1.7.1-2Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Risk 47

Severity

7.5

First published (updated )

CVE-2026-39835

go/golang.org/x/crypto/sshInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Risk 85

Severity

8.8

First published (updated )

CVE-2026-39828

golang/golang.org/x/crypto/sshInvoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

Risk 47

Severity

7.5

First published (updated )

CVE-2026-46597

npm/brace-expansionbrace-expansion: Large numeric range defeats documented `max` DoS protection

Risk 43

Severity

7.5

First published (updated )

CVE-2026-45149

pip/urllib3urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Risk 41

Severity

8.2

First published (updated )

CVE-2026-44431

Golang GoInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Risk 46

Severity

7.5

First published (updated )

CVE-2026-33814

RedisBloom RedisBloomRedisBloom RESTORE invalid memory access may allow remote code execution

Risk 83

Severity

7.7

First published (updated )

CVE-2026-25589

Redis redis-serverredis-server RESTORE invalid memory access may allow remote code execution

Risk 84

Severity

7.7

First published (updated )

CVE-2026-25243

Redis redis-serverredis-server use-after-free in unblock client flow may allow remote code execution

Risk 84

Severity

7.7

First published (updated )

CVE-2026-23479

pypi/clickPallets Click contains a command injection via Unsanitized Filename "click.edit()"

Risk 45

Severity

7.2

EPSS

0.03%

First published (updated )

CVE-2026-7246

Uuidjs Uuid Node.jsuuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

Risk 80

Severity

8.1

First published (updated )

CVE-2026-41907

npm/axiosAxios: no_proxy bypass via IP alias allows SSRF

Risk 43

Severity

7.5

First published (updated )

CVE-2026-42038

npm/axiosAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Risk 54

Severity

8.2

First published (updated )

CVE-2026-42041

npm/axiosAxios: Header Injection via Prototype Pollution

Risk 56

Severity

7.4

First published (updated )

CVE-2026-42035

npm/axiosAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Risk 56

Severity

7.4

First published (updated )

CVE-2026-42033

pip/tornadoIn Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesi…

Risk 44

Severity

7.2

First published (updated )

CVE-2026-35536

pypi/tornadoTornado has a DoS due to too many multipart parts

Risk 33

Severity

8.7

EPSS

0.07%

First published (updated )

CVE-2026-31958

Microsoft azl3 tensorflow 2.16.1-10TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Risk 51

Severity

7.8

EPSS

0.01%

First published (updated )

CVE-2026-2492

Axios Axios Node.jsAxios affected by Denial of Service via proto Key in mergeConfig

Risk 31

Severity

7.5

EPSS

0.03%

First published (updated )

CVE-2026-25639

pip/urllib3urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

Risk 33

Severity

8.9

EPSS

0.02%

First published (updated )

CVE-2026-21441

pypi/tornadoTornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters

Risk 43

Severity

7.5

First published (updated )

CVE-2025-67726

pypi/tornadoTornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

Risk 43

Severity

7.5

First published (updated )

CVE-2025-67725

pypi/urllib3urllib3 Streaming API improperly handles highly compressed data

Risk 50

Severity

8.9

First published (updated )

CVE-2025-66471

pypi/urllib3urllib3 allows an unbounded number of links in the decompression chain

Risk 50

Severity

8.9

First published (updated )

CVE-2025-66418

Tornado TornadoTornado vulnerable to excessive logging caused by malformed multipart form data

Risk 31

Severity

7.5

EPSS

0.12%

First published (updated )

CVE-2025-47287

pip/tornadoTornado has HTTP cookie parsing DoS vulnerability

Risk 46

Severity

7.5

First published (updated )

CVE-2024-52804

pip/certifiCertifi removes GLOBALTRUST root certificate

Risk 45

Severity

7.5

First published (updated )

CVE-2024-39689

kjd Internationalized Domain Names In ApplicationsDenial of Service via Quadratic Complexity in kjd/idna

Risk 46

Severity

7.5

First published (updated )

CVE-2024-3651

Fedoraproject Fedora`Cookie` HTTP header isn't stripped on cross-origin redirects

Risk 64

Severity

8.1

First published (updated )

CVE-2023-43804

Trending

Versions

go/golang.org/x/crypto/sshInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Microsoft azl3 kubevirt 1.7.1-2Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

go/golang.org/x/crypto/sshInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh

golang/golang.org/x/crypto/sshInvoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

npm/brace-expansionbrace-expansion: Large numeric range defeats documented `max` DoS protection

Don't miss critical vulnerabilities

pip/urllib3urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

Golang GoInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

RedisBloom RedisBloomRedisBloom RESTORE invalid memory access may allow remote code execution

Redis redis-serverredis-server RESTORE invalid memory access may allow remote code execution

Redis redis-serverredis-server use-after-free in unblock client flow may allow remote code execution

Don't miss critical vulnerabilities

pypi/clickPallets Click contains a command injection via Unsanitized Filename "click.edit()"

Uuidjs Uuid Node.jsuuid: Missing buffer bounds check in `v3`/`v5`/`v6` when `buf` is provided

npm/axiosAxios: no_proxy bypass via IP alias allows SSRF

npm/axiosAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

npm/axiosAxios: Header Injection via Prototype Pollution

Don't miss critical vulnerabilities

npm/axiosAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

pip/tornadoIn Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesi…

pypi/tornadoTornado has a DoS due to too many multipart parts

Microsoft azl3 tensorflow 2.16.1-10TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Axios Axios Node.jsAxios affected by Denial of Service via __proto__ Key in mergeConfig

Don't miss critical vulnerabilities

pip/urllib3urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

pypi/tornadoTornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters

pypi/tornadoTornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

pypi/urllib3urllib3 Streaming API improperly handles highly compressed data

pypi/urllib3urllib3 allows an unbounded number of links in the decompression chain

Don't miss critical vulnerabilities

Tornado TornadoTornado vulnerable to excessive logging caused by malformed multipart form data

pip/tornadoTornado has HTTP cookie parsing DoS vulnerability

pip/certifiCertifi removes GLOBALTRUST root certificate

kjd Internationalized Domain Names In ApplicationsDenial of Service via Quadratic Complexity in kjd/idna

Fedoraproject Fedora`Cookie` HTTP header isn't stripped on cross-origin redirects

Don't miss critical vulnerabilities

Company

Resources

Contact

Axios Axios Node.jsAxios affected by Denial of Service via proto Key in mergeConfig