CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 09:23 UTC )
This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,437 Show in the list Critical, last 7 days 355 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product redhat:ansible_automation_platform . Show all products
72 CVEs, showing 51 to 72 Previous Page 2 of 2 CVE Severity Title Published CVE-2026-19730 Medium 4.2 Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives Assigned by redhat
Aug 13, 2026 CVE-2026-18141 High 8.2 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header Assigned by redhat
Jul 31, 2026 CVE-2026-12701 Critical 9.0 Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport Assigned by redhat
Jul 20, 2026 CVE-2026-44495 High 7.7 Axios is a promise based HTTP client for the browser and Node.js. Jun 11, 2026 CVE-2026-46625 High 7.5 JavaScript Cookie is a JavaScript API for handling cookies, client-side. Jun 10, 2026 CVE-2026-11332 High 7.8 Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution Assigned by redhat
Jun 5, 2026 CVE-2026-48710 Known exploited
Medium 6.5 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks Assigned by GitHub_M
May 26, 2026 CVE-2026-47102 High 8.8 LiteLLM < 1.83.10 Privilege Escalation via User Update Assigned by VulnCheck
May 21, 2026 CVE-2026-47101 High 8.8 LiteLLM < 1.83.14 Privilege Escalation via API Key Generation Assigned by VulnCheck
May 21, 2026 CVE-2026-42208 Known exploited
Critical 9.3 LiteLLM: SQL injection in Proxy API key verification Assigned by GitHub_M
May 8, 2026 CVE-2026-42271 Known exploited
High 8.7 LiteLLM: Authenticated command execution via MCP stdio test endpoints Assigned by GitHub_M
May 8, 2026 CVE-2025-57847 Medium 6.4 Ansible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissions Assigned by redhat
Apr 8, 2026 CVE-2026-4800 High 8.1 lodash vulnerable to Code Injection via `_.template` imports key names Assigned by openjs
Mar 31, 2026 CVE-2025-9909 Medium 6.7 A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation component. Feb 27, 2026 CVE-2025-9908 Medium 6.7 A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. Feb 27, 2026 CVE-2025-9907 Medium 6.7 A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. Feb 27, 2026 CVE-2025-13465 Medium 6.9 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions Assigned by openjs
Jan 21, 2026 CVE-2024-11831 Medium 5.4 Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript Assigned by redhat
Feb 10, 2025 CVE-2024-9355 Medium 6.5 Golang-fips: golang fips zeroed buffer Assigned by redhat
Oct 1, 2024 CVE-2024-3727 High 8.3 Containers/image: digest type does not guarantee valid type Assigned by redhat
May 9, 2024 CVE-2024-1394 High 7.5 Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads Assigned by redhat
Mar 21, 2024 CVE-2023-44487 Known exploited
High 7.5 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Assigned by mitre
Oct 10, 2023
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
