漏洞公告

Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Guzzle: URI fragments disclosed in redirect Referer headers

Guzzle: Host-only cookie scope is not preserved

Guzzle: Unbounded response cookies risk denial of service

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability

Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability