Security advisories

medium2026-06-15

CVE-2026-48736-Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

symfony/symfony · GHSA-38cx-cq6f-5755

high2026-06-15

CVE-2026-48712-protobufjs: Denial of service through unbounded Any expansion during JSON conversion

protobufjs/protobuf.js · GHSA-wcpc-wj8m-hjx6

low2026-06-15

CVE-2026-48524-PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)

jpadilla/pyjwt · GHSA-fhv5-28vv-h8m8

high2026-06-15

CVE-2026-48489-Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

symfony/symfony · GHSA-6h46-9jf5-q59x

medium2026-06-15

CVE-2026-54269-protobufjs : Schema-derived names can shadow runtime-significant properties

protobufjs/protobuf.js · GHSA-f38q-mgvj-vph7

high2026-06-15

CVE-2026-12143-form-data: CRLF injection in form-data via unescaped multipart field names and filenames

form-data/form-data · GHSA-hmw2-7cc7-3qxx

high2026-06-15

CVE-2026-54264-@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker

angular/angular · GHSA-qxh6-94w6-9r5p

high2026-06-15

CVE-2026-54268-@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)

angular/angular · GHSA-48r7-hpm6-gfxm

high2026-06-15

CVE-2026-54266-@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning

angular/angular · GHSA-39pv-4j6c-2g6v

medium2026-06-15

CVE-2026-54265-@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)

angular/angular · GHSA-58w9-8g37-x9v5

medium2026-06-15

CVE-2026-50557-Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

angular/angular · GHSA-f3m7-gqxr-g87x

high2026-06-15

CVE-2026-50556-@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR

angular/angular · GHSA-gxx4-3xcv-f8qx

high2026-06-15

CVE-2026-50555-@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

angular/angular · GHSA-hqr9-c56f-3x7f

medium2026-06-15

CVE-2026-53655-node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

isaacs/node-tar · GHSA-vmf3-w455-68vh

medium2026-06-15

CVE-2026-53632-launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

vitejs/launch-editor · GHSA-v6wh-96g9-6wx3

medium2026-06-15

CVE-2026-53571-vite: `server.fs.deny` bypass on Windows alternate paths

vitejs/vite · GHSA-fx2h-pf6j-xcff

medium2026-06-15

CVE-2026-53550-JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

nodeca/js-yaml · GHSA-h67p-54hq-rp68

low2026-06-15

CVE-2026-49356-@babel/core: Arbitrary File Read via sourceMappingURL Comment

babel/babel · GHSA-4x5r-pxfx-6jf8

medium2026-06-15

CVE-2026-50184-@angular/service-worker: Request Credential & Cache Policy Stripping

angular/angular · GHSA-95qp-cmmw-mgqv

high2026-06-15

CVE-2026-50171-@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)

angular/angular · GHSA-p3vc-36g9-x9gr