Security advisories

medium2026-07-20

CVE-2026-73423-Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

withastro/astro · GHSA-8mv7-9c27-98vc

medium2026-07-20

CVE-2026-73424-Astro: Unauthenticated path override in the @astrojs/vercel ISR function

withastro/astro · GHSA-x27w-589x-frm2

low2026-07-20

CVE-2026-73425-@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

withastro/astro · GHSA-hp3v-mfqw-h74c

low2026-07-20

CVE-2026-12590-body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

expressjs/body-parser · GHSA-v422-hmwv-36x6

low2026-07-20

CVE-2026-59730-@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

withastro/astro · GHSA-r557-wffq-wvrc

medium2026-07-20

CVE-2026-59729-Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

withastro/astro · GHSA-f48w-9m4c-m7f5

medium2026-07-20

CVE-2026-59728-@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

withastro/astro · GHSA-8j5q-mfj2-5q9q

low2026-07-20

CVE-2026-59727-Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

withastro/astro · GHSA-7pw4-f3q4-r2p2

high2026-07-20

CVE-2026-59205-Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

python-pillow/pillow · GHSA-9hw9-ch79-4vh6

high2026-07-20

CVE-2026-59204-Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

python-pillow/pillow · GHSA-vjc4-5qp5-m44j

medium2026-07-20

CVE-2026-59203-Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

python-pillow/pillow · GHSA-pg7v-jwj7-p798

high2026-07-20

CVE-2026-59200-Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

python-pillow/pillow · GHSA-jjj6-mw9f-p565

high2026-07-20

CVE-2026-59199-Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

python-pillow/pillow · GHSA-6r8x-57c9-28j4

medium2026-07-20

CVE-2026-59198-Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

python-pillow/pillow · GHSA-fj7v-r99m-22gq

high2026-07-20

CVE-2026-59197-Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

python-pillow/pillow · GHSA-xj96-63gp-2gmr

high2026-07-20

CVE-2026-50651-Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

dotnet/runtime · GHSA-wp74-jgxh-gv4q

medium2026-07-20

CVE-2026-50659-Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability

dotnet/runtime · GHSA-74jp-vm22-8q8x

high2026-07-20

CVE-2026-50525-Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability

dotnet/runtime · GHSA-8q5v-6pqq-x66h

high2026-07-20

CVE-2026-50528-Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

dotnet/runtime · GHSA-qvw7-jm5c-6hqw

high2026-07-20

CVE-2026-50648-Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability

dotnet/runtime · GHSA-23rf-6693-g89p