漏洞公告

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text

aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

fast-uri vulnerable to host confusion via failed IDN canonicalization

Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

guzzlehttp/psr7: Host Confusion via Weak URI Host Validation

websocket-driver-ruby: Denial of service via malformed Host header

hono/jsx does not isolate context per request, leading to cross-request data disclosure

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication

Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability

Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability