Security advisories

low2026-06-15

CVE-2026-53538-python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

kludex/python-multipart · GHSA-6jv3-5f52-599m

low2026-06-15

CVE-2026-53537-python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters

kludex/python-multipart · GHSA-vffw-93wf-4j4q

critical2026-06-15

CVE-2026-54257-Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow

electron/electron · GHSA-q6m5-f73j-m9mc

high2026-06-15

CVE-2026-49853-Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

tornadoweb/tornado · GHSA-3x9g-8vmp-wqvf

high2026-06-15

CVE-2026-49855-tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

tornadoweb/tornado · GHSA-mgf9-4vpg-hj56

high2026-06-15

CVE-2026-48818-Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

kludex/starlette · GHSA-wqp7-x3pw-xc5r

medium2026-06-15

CVE-2026-48817-Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`

kludex/starlette · GHSA-x746-7m8f-x49c

medium2026-06-15

CVE-2026-48125-UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

faisalman/ua-parser-js · GHSA-9h5v-pfqq-x599

high2026-06-15

CVE-2026-54271-protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

protobufjs/protobuf.js · GHSA-pr59-h9ph-3fr8

medium2026-06-15

CVE-2026-54270-protobufjs: Memory amplification from preserved unknown fields in binary decode

protobufjs/protobuf.js · GHSA-94rc-8x27-4472

low2026-06-15

CVE-2026-65899-DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

cure53/dompurify · GHSA-vxr8-fq34-vvx9

high2026-06-15

Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography · GHSA-537c-gmf6-5ccf

high2026-06-15

CVE-2026-45591-Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

dotnet/aspnetcore · GHSA-f8h2-vmm9-qhj6

medium2026-06-15

CVE-2026-54274-aiohttp: Incomplete websocket frame payloads bypass memory limits

aio-libs/aiohttp · GHSA-xcgm-r5h9-7989

low2026-06-15

CVE-2026-54275-aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections

aio-libs/aiohttp · GHSA-4m7w-qmgq-4wj5

low2026-06-15

CVE-2026-54280-aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect

aio-libs/aiohttp · GHSA-9x8q-7h8h-wcw9

medium2026-06-15

CVE-2026-54273-aiohttp: HTTP/1 Pipelined Requests Queue Without Limit

aio-libs/aiohttp · GHSA-4fvr-rgm6-gqmc

medium2026-06-15

CVE-2026-54278-aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup

aio-libs/aiohttp · GHSA-g3cq-j2xw-wf74

medium2026-06-15

CVE-2026-54277-aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines

aio-libs/aiohttp · GHSA-63hw-fmq6-xxg2

medium2026-06-15

CVE-2026-54276-aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges

aio-libs/aiohttp · GHSA-hpj7-wq8m-9hgp