Security advisories

high2026-06-15

CVE-2026-47835-Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

spring-projects/spring-ai · GHSA-cmwh-w62w-r2mf

high2026-06-15

CVE-2026-41708-Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

spring-attic/spring-cloud-sleuth · GHSA-26m2-9g2q-v45q

critical2026-06-15

CVE-2026-30121-Remotion: arbitrary file write vulnerability

remotion-dev/remotion · GHSA-g6pc-6676-c23j

critical2026-06-15

CVE-2026-30120-Remotion: remote code execution (RCE) vulnerability

remotion-dev/remotion · GHSA-2jqp-f4gr-44fr

low2026-06-15

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

nuxt/nuxt · GHSA-rq7w-g337-39qq

high2026-06-15

CVE-2026-11417-aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

aws/aws-cdk · GHSA-999r-qq7v-r334

medium2026-06-15

CVE-2026-50560-Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature

netty/netty · GHSA-563q-j3cm-6jxm

medium2026-06-15

CVE-2026-50020-Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

netty/netty · GHSA-hvcg-qmg6-jm4c

high2026-06-15

CVE-2026-50011-Netty: Unbounded pre-allocation in RedisArrayAggregator from RESP array length

netty/netty · GHSA-5w86-c3rq-vjj7

high2026-06-15

CVE-2026-50010-Netty: Wrapping plain trust manager silently disables hostname verification

netty/netty · GHSA-c653-97m9-rcg9

medium2026-06-15

CVE-2026-50009-Netty: QUIC stateless reset token material exposed through header-visible connection IDs

netty/netty · GHSA-cq4q-cv5g-r8q5

high2026-06-15

CVE-2026-48748-Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

netty/netty · GHSA-4grm-h2qv-h6w6

medium2026-06-15

CVE-2026-48988-markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations

markdown-it/markdown-it · GHSA-6v5v-wf23-fmfq

high2026-06-15

CVE-2026-54283-Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

kludex/starlette · GHSA-82w8-qh3p-5jfq

medium2026-06-15

CVE-2026-54285-OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

open-telemetry/opentelemetry-js · GHSA-8988-4f7v-96qf

low2026-06-15

CVE-2026-54282-Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

kludex/starlette · GHSA-jp82-jpqv-5vv3

medium2026-06-15

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

tornadoweb/tornado · GHSA-pw6j-qg29-8w7f

high2026-06-15

CVE-2026-54281-Nest: Middleware Bypass on Fastify via Trailing Slash

nestjs/nest · GHSA-6v32-fjc9-9qf6

high2026-06-15

CVE-2026-53539-python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service

kludex/python-multipart · GHSA-5rvq-cxj2-64vf

low2026-06-15

CVE-2026-53540-python-multipart: Negative Content-Length in parse_form buffers the entire body in memory

kludex/python-multipart · GHSA-v9pg-7xvm-68hf