Security advisories

high2026-07-24

CVE-2026-55575-LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

harttle/liquidjs · GHSA-g357-x5c3-c72p

medium2026-07-24

CVE-2026-55510-ImageMagick: Use-After-Free in crafted 8BIM when identifying an image

imagemagick/imagemagick · GHSA-ff5c-8x9r-8qcw

high2026-07-24

CVE-2026-54673-electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

electron-userland/electron-builder · GHSA-p2f4-r6v6-j797

high2026-07-24

CVE-2026-54672-electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`

electron-userland/electron-builder · GHSA-7g7r-gx96-252g

low2026-07-23

CVE-2026-54696-Ruby json: JSON generator heap buffer overflow when streaming to an IO

ruby/json · GHSA-x2f5-4prf-w687

medium2026-07-23

CVE-2026-55223-c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets

swaldman/c3p0 · GHSA-w6w4-rjh9-9r58

medium2026-07-23

CVE-2026-53669-React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

remix-run/react-router · GHSA-wrjc-x8rr-h8h6

medium2026-07-23

CVE-2026-53668-React Router: Open redirect leading to XSS

remix-run/react-router · GHSA-jjmj-jmhj-qwj2

medium2026-07-23

CVE-2026-53667-React Router: RSCErrorHandler Missing Protocol Validation (XSS)

remix-run/react-router · GHSA-h8fp-f39c-q6mh

medium2026-07-23

CVE-2026-53666-React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

remix-run/react-router · GHSA-337j-9hxr-rhxg

medium2026-07-23

CVE-2026-53467-ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

imagemagick/imagemagick · GHSA-8g53-9m3c-69xg

high2026-07-23

CVE-2026-47219-find-my-way: DDoS with HTTP2

delvedor/find-my-way · GHSA-c96f-x56v-gq3h

high2026-07-23

CVE-2026-59935-pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

py-pdf/pypdf · GHSA-g867-7843-wf8q

high2026-07-23

CVE-2026-59936-pypdf: Possible infinite loop for not terminated inline images

py-pdf/pypdf · GHSA-5xf7-4p34-54qr

medium2026-07-23

CVE-2026-59937-pypdf: Possible long runtimes for repeated malformed cross-reference entries

py-pdf/pypdf · GHSA-55h5-xmcq-c37v

medium2026-07-23

CVE-2026-59938-pypdf: Possible large memory usage for wrong image dimensions

py-pdf/pypdf · GHSA-5qjq-93h5-hrgp

high2026-07-23

CVE-2026-45623-PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

postcss/postcss · GHSA-6g55-p6wh-862q

high2026-07-23

CVE-2026-59933-PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

phpoffice/phpspreadsheet · GHSA-xh5m-36r6-47m3

high2026-07-23

CVE-2026-59932-PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

phpoffice/phpspreadsheet · GHSA-2mrg-gjxq-2gvr

high2026-07-23

CVE-2026-59931-PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

phpoffice/phpspreadsheet · GHSA-6hq5-7373-42rg