Security advisories

high2026-07-21

CVE-2026-59880-Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

immutable-js/immutable-js · GHSA-xvcm-6775-5m9r

high2026-07-21

CVE-2026-59879-Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

immutable-js/immutable-js · GHSA-v56q-mh7h-f735

medium2026-07-21

CVE-2026-59882-guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

guzzle/psr7 · GHSA-c2w2-prh8-qm98

high2026-07-21

CVE-2026-61666-websocket-driver-ruby: Denial of service via malformed Host header

faye/websocket-driver-ruby · GHSA-2x63-gw47-w4mm

medium2026-07-21

CVE-2026-59896-hono/jsx does not isolate context per request, leading to cross-request data disclosure

honojs/hono · GHSA-hvrm-45r6-mjfj

medium2026-07-21

CVE-2026-59895-Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

honojs/hono · GHSA-w62v-xxxg-mg59

critical2026-07-21

CVE-2026-64825-Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

home-assistant/core · GHSA-5hxg-r395-fqxx

medium2026-07-21

CVE-2026-59897-Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

honojs/hono · GHSA-xgm2-5f3f-mvvc

medium2026-07-21

Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

honojs/node-server · GHSA-frvp-7c67-39w9

high2026-07-21

CVE-2026-54291-PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

pgjdbc/pgjdbc · GHSA-j92g-9f8w-j867

high2026-07-21

CVE-2026-56170-Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability

dotnet/aspnetcore · GHSA-j8gr-8fp3-5q5h

high2026-07-21

CVE-2026-50526-Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability

dotnet/sdk · GHSA-55jh-fwmh-39m4

high2026-07-21

CVE-2026-47300-Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability

dotnet/aspnetcore · GHSA-8prm-248r-h957

high2026-07-21

CVE-2026-47303-Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability

dotnet/aspnetcore · GHSA-2p3q-h3hg-jcqq

high2026-07-21

CVE-2026-50527-Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability

dotnet/runtime · GHSA-mmjf-rqrv-855v

high2026-07-21

CVE-2026-50650-Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

dotnet/wpf · GHSA-2969-4q4w-w5h3

low2026-07-21

CVE-2026-73491-Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

flavorjones/loofah · GHSA-8whx-365g-h9vv

medium2026-07-20

CVE-2026-67354-Guzzle: URI fragments disclosed in redirect Referer headers

guzzle/guzzle · GHSA-h95v-h523-3mw8

medium2026-07-20

CVE-2026-67355-Guzzle: Host-only cookie scope is not preserved

guzzle/guzzle · GHSA-wm3w-8rrp-j577

medium2026-07-20

CVE-2026-67353-Guzzle: Unbounded response cookies risk denial of service

guzzle/guzzle · GHSA-f283-ghqc-fg79