Tagged “ghsa”

CVEs tagged ghsa, newest first.

5692 CVEsRSS

CVE-2026-50650High· 7.8

3mo ago

Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

▾ TwilightMicrosoft · Microsoft.WindowsDesktop.App.Runtime.win-x64EPSS 0.46%via GHSA

GHSA-8whx-365g-h9vvLow

3mo ago

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

▾ Sunlitloofah · loofahvia GHSA

CVE-2026-55831High· 7.5

3mo ago

io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)

A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing…

▾ TwilightRed Hat · Red Hat JBoss EAP 8.1 for RHEL 8EPSS 0.66%via CSAF

CVE-2026-55833High· 7.5

3mo ago

netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833)

A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to ex…

Tagged “ghsa”

Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)

netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833)

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Guzzle: Unbounded response cookies risk denial of service

Guzzle: Host-only cookie scope is not preserved

Guzzle: URI fragments disclosed in redirect Referer headers

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Guzzle: Proxy-Authorization headers can be sent to origin servers

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

Directus: Authorization-dependent response served from unsegmented cache key

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

File Browser: Colliding username normalization gives two users the same home directory

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Axios: Prototype pollution gadgets can alter axios request construction

Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`