Security advisories

high2026-07-20

CVE-2026-50524-Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

dotnet/runtime · GHSA-w7cw-xp7h-6j5j

high2026-07-20

CVE-2026-47304-Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

dotnet/runtime · GHSA-g8r8-53c2-pm3f

high2026-07-20

CVE-2026-47302-Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

dotnet/runtime · GHSA-cvvh-rhrc-wg4q

high2026-07-20

CVE-2026-57108-Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

dotnet/runtime · GHSA-rp2p-6cmp-jxj9

high2026-07-20

CVE-2026-67320-Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

axios/axios · GHSA-gcfj-64vw-6mp9

medium2026-07-20

CVE-2026-67321-Axios form serializer maxDepth bypass via {} metatoken

axios/axios · GHSA-hcpx-6fm6-wx23

medium2026-07-20

CVE-2026-67319-Axios: Nested axios option objects can consume polluted prototype values

axios/axios · GHSA-7q8q-rj6j-mhjq

medium2026-07-20

CVE-2026-67318-Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

axios/axios · GHSA-mwf2-3pr3-8698

medium2026-07-20

CVE-2026-67317-Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`

axios/axios · GHSA-jqh4-m9w3-8hp9

medium2026-07-20

CVE-2026-67316-Axios: Prototype pollution gadgets can alter axios request construction

axios/axios · GHSA-mmx7-hfxf-jppx

medium2026-07-20

CVE-2026-67315-Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

axios/axios · GHSA-f4gw-2p7v-4548

high2026-07-20

CVE-2026-62685-File Browser: Colliding username normalization gives two users the same home directory

filebrowser/filebrowser · GHSA-7rc3-g7h6-22m7

low2026-07-20

CVE-2026-62684-File Browser: Share API exposes the password hash and bypass token

filebrowser/filebrowser · GHSA-833g-cqhp-h72j

medium2026-07-20

CVE-2026-62843-File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

filebrowser/filebrowser · GHSA-83xp-526h-j3ww

medium2026-07-20

CVE-2026-59876-protobufjs: Text Format string map parsing can mutate returned map object prototype

protobufjs/protobuf.js · GHSA-jfj6-75fj-8934

medium2026-07-20

CVE-2026-59877-protobufjs: Denial of Service via infinite loop in .proto option parsing

protobufjs/protobuf.js · GHSA-j3f2-48v5-ccww

medium2026-07-20

CVE-2026-14631-webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

webpack/webpack-dev-server · GHSA-m28w-2pqf-7qgj

medium2026-07-20

CVE-2026-14620-webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

webpack/webpack-dev-server · GHSA-f5vj-f2hx-8m93

medium2026-07-20

CVE-2026-59883-Guzzle: Cookie Disclosure and Injection via IP-Address Domains

guzzle/guzzle · GHSA-g446-98w2-8p5w

high2026-07-20

CVE-2026-59731-Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

withastro/astro · GHSA-vj59-8hwv-xxmv