Security advisories

low2026-06-15

CVE-2026-54279-aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence

aio-libs/aiohttp · GHSA-2fqr-mr3j-6wp8

low2026-06-15

CVE-2026-50269-aiohttp: CRLF injection in multipart headers

aio-libs/aiohttp · GHSA-m6qw-4cw2-hm4m

low2026-06-15

CVE-2026-53663-React Router: Potential CSRF via PUT/PATCH/DELETE document requests

remix-run/react-router · GHSA-84g9-w2xq-vcv6

critical2026-06-15

CVE-2026-53633-Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

vitest-dev/vitest · GHSA-g8mr-85jm-7xhm

low2026-06-15

CVE-2026-65900-DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes

cure53/dompurify · GHSA-gvmj-g25r-r7wr

medium2026-06-15

CVE-2026-49978-DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

cure53/dompurify · GHSA-rp9w-3fw7-7cwq

low2026-06-15

CVE-2026-65901-DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

cure53/dompurify · GHSA-x4vx-rjvf-j5p4

medium2026-06-15

CVE-2026-65902-DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

cure53/dompurify · GHSA-76mc-f452-cxcm

medium2026-06-15

CVE-2026-49458-DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

cure53/dompurify · GHSA-hpcv-96wg-7vj8

medium2026-06-15

CVE-2026-49459-DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

cure53/dompurify · GHSA-r47g-fvhr-h676

medium2026-06-15

CVE-2026-48525-PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS

jpadilla/pyjwt · GHSA-w7vc-732c-9m39

medium2026-06-15

CVE-2026-48522-PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes

jpadilla/pyjwt · GHSA-993g-76c3-p5m4

high2026-06-15

CVE-2026-48526-PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

jpadilla/pyjwt · GHSA-xgmm-8j9v-c9wx

medium2026-06-15

CVE-2026-48523-PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys

jpadilla/pyjwt · GHSA-jq35-7prp-9v3f

medium2026-06-15

Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

nodemailer/nodemailer · GHSA-268h-hp4c-crq3

medium2026-06-15

Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

nodemailer/nodemailer · GHSA-wqvq-jvpq-h66f

high2026-06-15

CVE-2026-82662-Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

nodemailer/nodemailer · GHSA-r7g4-qg5f-qqm2

medium2026-06-15

CVE-2026-48784-Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

symfony/symfony · GHSA-h5x3-xfc9-m39h

medium2026-06-15

CVE-2026-48760-Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

symfony/symfony · GHSA-v3wm-qf9p-c549

medium2026-06-15

CVE-2026-48747-Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

symfony/symfony · GHSA-rrj9-5q2j-4gvr