•23 minutes ago•GHSA-2F96-G7MH-G2HX
8.8GHSA-2F96-G7MH-G2HX: Command Injection Bypass in GitPython Options Validation
GitPython prior to version 3.1.51 contains a command injection vulnerability due to flaws in its option validation routine. By exploiting Git's native argument parser behavior, specifically long-option abbreviation resolution and short-option clustering, attackers can bypass the check_unsafe_options blocklist to execute arbitrary OS commands.
1 views•5 min read
•about 1 hour ago•CVE-2026-59879
8.7CVE-2026-59879: Infinite Loop and Integer Overflow in Immutable.js List Sizing
CVE-2026-59879 describes a critical integer overflow vulnerability in the Immutable.js library when handling indices near 32-bit boundaries. An attacker can leverage this flaw to cause a denial of service via CPU thread lockup or process crashes, as well as data corruption through silent size truncation.
3 views•8 min read
•about 2 hours ago•CVE-2026-54291
8.2CVE-2026-54291: Silent Channel-Binding Authentication Downgrade in PostgreSQL JDBC Driver (pgjdbc)
A critical security bypass and algorithm downgrade vulnerability in the PostgreSQL JDBC Driver (pgjdbc) allows Man-in-the-Middle (MITM) attackers to silently bypass channel binding requirements. When configured with `channelBinding=require`, the driver fails to assert that the negotiated SCRAM mechanism utilizes channel binding, allowing downgrade to plain SCRAM-SHA-256 when encountering unsupported server certificate signature algorithms (such as Ed25519 or Ed448).
5 views•7 min read
•about 3 hours ago•CVE-2026-56170
7.5CVE-2026-56170: Remote Denial of Service via Resource Exhaustion in ASP.NET Core
CVE-2026-56170 is a high-severity Remote Denial of Service (DoS) vulnerability in Microsoft's ASP.NET Core framework. The vulnerability spans three separate resource-management vectors within the ASP.NET Core ecosystem, including SignalR Stateful Reconnect allocations, JSON Patch Type Confusion leading to stack exhaustion, and Kestrel HTTP/2 synchronization issues. An unauthenticated remote attacker can exploit these issues to cause process-terminating exceptions, rendering applications unavailable.
5 views•7 min read
•about 4 hours ago•GHSA-8WHX-365G-H9VV
2.3GHSA-8whx-365g-h9vv: HTML5 Named Whitespace Bypass in Loofah allowed_uri? Validation
The Loofah Ruby gem version 2.25.0 and 2.25.1 contains an incomplete validation vulnerability in its public string-level utility Loofah::HTML5::Scrub.allowed_uri?. This helper fails to detect 'javascript:' URIs that are split by HTML5 named whitespace character references such as 	 and 
. Applications manually invoking this utility to validate links are vulnerable to stored Cross-Site Scripting (XSS), as browsers parse and remove these entities during rendering.
4 views•7 min read
•about 5 hours ago•CVE-2026-50525
7.5CVE-2026-50525: Denial of Service Vulnerability in Microsoft .NET XML Cryptography Stack
CVE-2026-50525 is a high-severity Denial of Service (DoS) vulnerability in the Microsoft .NET XML Cryptography stack. The vulnerability resides in the `System.Security.Cryptography.Xml` library, specifically within the `EncryptedXml` processing engine. Unauthenticated remote attackers can exploit this flaw by sending specifically crafted XML documents containing nested or recursive structures, or utilizing resource-intensive transforms. Processing such payloads leads to infinite CPU loops, stack exhaustion, or memory starvation, resulting in application termination.
5 views•6 min read
•about 6 hours ago•CVE-2026-50659
6.5CVE-2026-50659: SMTP Command and Header Injection in .NET System.Net.Mail
An improper encoding and escaping vulnerability in the .NET SMTP client component allows network-based attackers to perform SMTP command smuggling and email spoofing by injecting control characters into email fields.
5 views•8 min read
•about 7 hours ago•CVE-2026-50651
7.5CVE-2026-50651: Denial of Service via Uncontrolled Resource Allocation in .NET System.Net.Http
CVE-2026-50651 is a high-severity Denial of Service vulnerability in Microsoft .NET runtimes, SDKs, and Visual Studio installations. It stems from a weakness in System.Net.Http (CWE-770), where the HTTP/2 connection handling state machine fails to throttle server-initiated protocol streams and control frames. An attacker-controlled server can exploit this by returning highly fragmented or infinite control and continuation frame sequences. This forces the client to allocate memory indefinitely on the managed heap, eventually provoking an unhandled Out-of-Memory (OOM) exception and application crash.
6 views•6 min read
•about 8 hours ago•CVE-2026-59197
8.2CVE-2026-59197: Heap Out-of-Bounds Write and Division-by-Zero in Pillow libImaging
A heap out-of-bounds write vulnerability exists in Pillow prior to version 12.3.0 due to an integer overflow during image expansion calculations. The subsequent patch introduced a division-by-zero regression causing denial of service.
6 views•3 min read
•about 9 hours ago•CVE-2026-59198
6.5CVE-2026-59198: Heap Out-of-Bounds Read in Pillow TGA RLE Encoder
CVE-2026-59198 is a high-severity heap out-of-bounds read vulnerability in Pillow, the Python imaging library, affecting versions from 5.2.0 up to 12.3.0. The vulnerability occurs in the TGA RLE compression path due to a calculation mismatch between the allocated packed 1-bit row buffer and the byte-level pixel stride assumption in the C-level encoder. This mismatch allows an attacker to leak up to approximately 57 KB of adjacent process heap memory directly into generated TGA image files.
5 views•8 min read
•about 10 hours ago•CVE-2026-59199
7.5CVE-2026-59199: Signed 32-Bit Integer Overflow and Heap Backward Underwrite in Pillow
A critical signed 32-bit integer overflow vulnerability was identified in Pillow (Python Imaging Library) versions prior to 12.3.0. The vulnerability resides within the native C extension library (libImaging) during coordinate and bounding box calculations in functions like ImagingPaste and ImagingFill2. Exploitation can bypass bounds and clipping safety checks, leading to a controlled heap backward underwrite and application crash.
8 views•6 min read
•about 11 hours ago•CVE-2026-59200
7.5CVE-2026-59200: Remote Denial of Service via PDF Decompression Bomb in Pillow
CVE-2026-59200 is a high-severity uncontrolled resource consumption vulnerability in the Pillow Python Imaging Library. The flaw resides in the PDF stream decoder, allowing remote, unauthenticated attackers to trigger host out-of-memory crashes by submitting malicious PDF decompression bombs.
7 views•5 min read