Security advisories

low2026-06-19

CVE-2026-54905-Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity

ruby-concurrency/concurrent-ruby · GHSA-wv3x-4vxv-whpp

high2026-06-19

CVE-2026-54904-Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`

ruby-concurrency/concurrent-ruby · GHSA-h8w8-99g7-qmvj

high2026-06-19

CVE-2026-54903-Oj: Integer Overflow in Oj.load 2GB String Handling

ohler55/oj · GHSA-475m-ph3x-64gp

high2026-06-19

CVE-2026-54902-Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

ohler55/oj · GHSA-m578-w5vf-rfcm

high2026-06-19

CVE-2026-54901-Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking

ohler55/oj · GHSA-vwm4-62gf-x745

high2026-06-19

CVE-2026-54900-Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

ohler55/oj · GHSA-9cv6-qcjw-4grx

high2026-06-19

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

kozou-dev/kozou · GHSA-v52w-28xh-v562

high2026-06-19

CVE-2026-54784-CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

corewcf/corewcf · GHSA-2288-8h3r-cqgg

high2026-06-19

CVE-2026-54783-CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

corewcf/corewcf · GHSA-gqv6-pwcg-87r8

critical2026-06-19

CVE-2026-54782-CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

corewcf/corewcf · GHSA-xjr9-gg9q-jx3v

high2026-06-19

CVE-2026-54781-CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

corewcf/corewcf · GHSA-48pq-2xq3-c2m4

low2026-06-19

CVE-2026-54780-CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass

corewcf/corewcf · GHSA-4v55-cpmv-3vcm

medium2026-06-19

CVE-2026-54779-CoreWCF: SAML token replay protection is inoperative

corewcf/corewcf · GHSA-9jr3-rj99-8jq3

medium2026-06-19

CVE-2026-54778-CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution

corewcf/corewcf · GHSA-q6v9-43v5-jv9q

medium2026-06-19

CVE-2026-54777-CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance

corewcf/corewcf · GHSA-6jj2-4q5c-x8g6

medium2026-06-19

CVE-2026-54776-CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade

corewcf/corewcf · GHSA-wjpq-6766-7f5j

medium2026-06-19

CVE-2026-54775-CoreWCF: Kafka consume pump halts permanently on a Kafka tombstone (null-value record), causing persistent endpoint denial of service.

corewcf/corewcf · GHSA-m744-jhq9-ppw6

high2026-06-19

CVE-2026-54774-CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

corewcf/corewcf · GHSA-rpj7-hr7h-w6p9

medium2026-06-19

CVE-2026-54773-CoreWCF: WS-Security signature substitution via document-wide Signature lookup

corewcf/corewcf · GHSA-jc6x-rj79-w4mx

high2026-06-19

CVE-2026-54772-CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake

corewcf/corewcf · GHSA-p86g-xrr2-pf7c