Security advisories

medium2026-07-20

CVE-2026-59927-Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files

lepture/mistune · GHSA-8mpj-m6qm-5qr8

high2026-07-20

CVE-2026-59928-Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

lepture/mistune · GHSA-ffq3-xpv3-j92q

medium2026-07-20

CVE-2026-59868-js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml

nodeca/js-yaml · GHSA-g796-fgmg-93mv

high2026-07-20

CVE-2026-59869-js-yaml: YAML merge-key chains can force quadratic CPU consumption

nodeca/js-yaml · GHSA-52cp-r559-cp3m

medium2026-07-20

CVE-2026-59870-js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

nodeca/js-yaml · GHSA-724g-mxrg-4qvm

medium2026-07-20

CVE-2026-55668-File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

filebrowser/filebrowser · GHSA-8wc8-hf36-mjh9

high2026-07-20

CVE-2026-55667-File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

filebrowser/filebrowser · GHSA-fmm7-x4gx-8jhr

medium2026-07-20

CVE-2026-54562-Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

cloudreve/cloudreve · GHSA-x756-g4x3-c64m

high2026-07-20

CVE-2026-54560-Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

cloudreve/cloudreve · GHSA-vgj4-345g-jcf8

medium2026-07-20

CVE-2026-55798-Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path

python-pillow/pillow · GHSA-4x4j-2g7c-83w6

high2026-07-20

CVE-2026-55380-Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

python-pillow/pillow · GHSA-phj9-mv4w-65pm

high2026-07-20

CVE-2026-55379-Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

python-pillow/pillow · GHSA-45hq-cxwh-f6vc

high2026-07-20

CVE-2026-54060-Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

python-pillow/pillow · GHSA-5x94-69rx-g8h2

high2026-07-20

CVE-2026-54059-Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

python-pillow/pillow · GHSA-8v84-f9pq-wr9x

medium2026-07-20

CVE-2026-73422-Astro: Reflected XSS via unescaped View Transition animation properties

withastro/astro · GHSA-4g3v-8h47-v7g6

high2026-07-20

CVE-2026-54058-Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)

python-pillow/pillow · GHSA-62p4-gmf7-7g93

high2026-07-20

CVE-2026-53515-@better-auth/sso: SSO provider may allow registration for any org member without a checking their role

better-auth/better-auth · GHSA-gv74-j8m3-fg5f

high2026-07-20

CVE-2026-13149-brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

juliangruber/brace-expansion · GHSA-3jxr-9vmj-r5cp

high2026-07-20

CVE-2026-59948-Composer: Arbitrary file write outside vendor via malicious transitive package name

composer/composer · GHSA-499r-g7pc-vmp9

high2026-07-20

CVE-2026-55514-vLLM denial of service via prompt embeds on M-RoPE models

vllm-project/vllm · GHSA-33cg-gxv8-3p8g