Latest medium severity vulnerabilities for "ibm db2 genius hub"

IBM Db2 Genius HubUse of Potentially Dangerous Functionthat in IBM Db2 Genius Hub

Risk 22

Severity

4.3

First published (updated )

CVE-2026-14501

npm/react-routerReact Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

Risk 40

Severity

6.6

First published (updated )

CVE-2026-40181

Microsoft azl3 docker-compose 2.27.0-9Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Risk 38

Severity

6.1

First published (updated )

CVE-2026-27136

Microsoft azl3 prometheus-adapter 0.12.0-5Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Risk 37

Severity

6.5

First published (updated )

CVE-2026-25680

Microsoft azl3 sriov-network-device-plugin 3.7.0-5Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Risk 38

Severity

6.1

First published (updated )

CVE-2026-42502

Microsoft azl3 telegraf 1.31.0-19Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Risk 38

Severity

6.1

First published (updated )

CVE-2026-42506

Microsoft azl3 sriov-network-device-plugin 3.7.0-5Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Risk 38

Severity

6.1

First published (updated )

CVE-2026-25681

go/golang.org/x/crypto/ssh/agentInvoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

Risk 29

Severity

5.3

First published (updated )

CVE-2026-46598

go/golang.org/x/crypto/sshInvoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

Risk 41

Severity

6.5

First published (updated )

CVE-2026-39827

pip/idnaInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Risk 33

Severity

6.9

First published (updated )

CVE-2026-45409

Redis redis-serverredis-server Lua use-after-free may allow remote code execution

Risk 84

Severity

6.1

First published (updated )

CVE-2026-23631

npm/axiosAxios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Risk 34

Severity

5.4

First published (updated )

CVE-2026-42042

npm/axiosAxios: unbounded recursion in toFormData causes DoS via deeply nested request data

Risk 43

Severity

6.9

First published (updated )

CVE-2026-42039

npm/axiosAxios: HTTP adapter streamed responses bypass maxContentLength

Risk 27

Severity

5.3

First published (updated )

CVE-2026-42036

npm/axiosAxios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0

Risk 27

Severity

5.3

First published (updated )

CVE-2026-42034

npm/axiosAxios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

Risk 27

Severity

5.3

First published (updated )

CVE-2026-42037

npm/dompurifyDOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

Risk 38

Severity

6

First published (updated )

CVE-2026-41240

npm/dompurifyDOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

Risk 51

Severity

6.8

First published (updated )

CVE-2026-41239

npm/dompurifyDOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

Risk 46

Severity

6.9

First published (updated )

CVE-2026-41238

pypi/python-dotenvpython-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

Risk 48

Severity

6.6

First published (updated )

CVE-2026-28684

Axios Axios Node.jsAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Risk 72

Severity

6.3

First published (updated )

CVE-2025-62718

npm/axiosAxios HTTP/2 Session Cleanup State Corruption Vulnerability

Risk 35

Severity

5.9

First published (updated )

CVE-2026-39865

npm/lodashlodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Risk 40

Severity

6.5

First published (updated )

CVE-2026-2950

pypi/requestsRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

Risk 32

Severity

5.5

First published (updated )

CVE-2026-25645

pypi/pygmentspygments archetype.py AdlLexer redos

Risk 17

Severity

4.8

EPSS

0.01%

First published (updated )

CVE-2026-4539

pypi/pytestpytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, whic…

Risk 48

Severity

6.8

First published (updated )

CVE-2025-71176

npm/lodashPrototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Risk 54

Severity

6.9

First published (updated )

CVE-2025-13465

pypi/tornadoTornado vulnerable to Header Injection and XSS via reason argument

Risk 38

Severity

6.1

First published (updated )

CVE-2025-67724

codemirror Markdown ModeCodeMirror Markdown Mode markdown.js redos

Risk 20

Severity

5.5

EPSS

0.05%

First published (updated )

CVE-2025-6493

pip/urllib3urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Risk 27

Severity

6.1

EPSS

0.01%

First published (updated )

CVE-2025-50181

Trending

Versions

IBM Db2 Genius HubUse of Potentially Dangerous Functionthat in IBM Db2 Genius Hub

npm/react-routerReact Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

Microsoft azl3 docker-compose 2.27.0-9Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Microsoft azl3 prometheus-adapter 0.12.0-5Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Microsoft azl3 sriov-network-device-plugin 3.7.0-5Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Don't miss critical vulnerabilities

Microsoft azl3 telegraf 1.31.0-19Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Microsoft azl3 sriov-network-device-plugin 3.7.0-5Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

go/golang.org/x/crypto/ssh/agentInvoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

go/golang.org/x/crypto/sshInvoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

pip/idnaInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Don't miss critical vulnerabilities

Redis redis-serverredis-server Lua use-after-free may allow remote code execution

npm/axiosAxios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

npm/axiosAxios: unbounded recursion in toFormData causes DoS via deeply nested request data

npm/axiosAxios: HTTP adapter streamed responses bypass maxContentLength

npm/axiosAxios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0

Don't miss critical vulnerabilities

npm/axiosAxios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream

npm/dompurifyDOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

npm/dompurifyDOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

npm/dompurifyDOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

pypi/python-dotenvpython-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

Don't miss critical vulnerabilities

Axios Axios Node.jsAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

npm/axiosAxios HTTP/2 Session Cleanup State Corruption Vulnerability

npm/lodashlodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

pypi/requestsRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

pypi/pygmentspygments archetype.py AdlLexer redos

Don't miss critical vulnerabilities

pypi/pytestpytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, whic…

npm/lodashPrototype Pollution Vulnerability in Lodash _.unset and _.omit functions

pypi/tornadoTornado vulnerable to Header Injection and XSS via reason argument

codemirror Markdown ModeCodeMirror Markdown Mode markdown.js redos

pip/urllib3urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Don't miss critical vulnerabilities

Company

Resources

Contact