Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
CVE-2026-50524
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET
2026-07-21 归档
今日共收录 1301 条安全情报，包含 465 个 CVE，462 篇安全通告，以及 91 篇研究论文。
← 返回归档列表Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
CVE-2026-47304
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET
Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability
CVE-2026-47302
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET
Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
CVE-2026-57108
## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the
protobufjs: Text Format string map parsing can mutate returned map object prototype
CVE-2026-59876
## Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A
protobufjs: Denial of Service via infinite loop in .proto option parsing
CVE-2026-59877
## Summary protobufjs parsed option names by advancing through schema tokens until it reached an `=` token, without che
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
CVE-2026-14631
### Impact An unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
CVE-2026-14620
### Impact The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
CVE-2026-59883
### Impact `CookieJar` does not restrict a cookie scoped to an IP address to the exact host that set it. When a stored
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
CVE-2026-59946
## Summary A Composer package declares its executables in the `bin` field of its `composer.json`. When Composer install
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
CVE-2026-59947
## Summary When Composer is run with -vvv (debug verbosity), it could print a credential that was embedded directly in
node-tar: Decompression/parse DoS via unlimited input
CVE-2026-59873
### Summary A **Decompression/parse DoS via unlimited input** vulnerability in `node-tar` allows an attacker to exhaust
node-tar: Negative tar entry size causes infinite loop in archive replace
CVE-2026-59874
### Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop fore
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
CVE-2026-13311
### Summary `shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the
Directus: Authorization-dependent response served from unsegmented cache key
CVE-2026-61836
## Summary When response caching is enabled (`CACHE_ENABLED=true`), the cache-key derivation in `api/src/utils/get-cach
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
CVE-2026-61835
### Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address `0.0.0.0`.
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
CVE-2026-61740
## Summary When LightRAG is deployed with `LIGHTRAG_API_KEY` set but `AUTH_ACCOUNTS` unset (an officially documented "A
Mistune: Arbitrary File Read via Include directive path traversal
CVE-2026-59924
### Summary A path traversal issue exists in mistune's `Include` directive when markdown files are processed using `md.
Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)
CVE-2026-59922
## Summary **Type:** Algorithmic-complexity denial of service. A run of N closed pairs `~~x~~~~x~~...` (or the analogou
Mistune: XSS via unescaped class option in Admonition directive
CVE-2026-59926
In `src/mistune/directives/admonition.py`, the `render_admonition()` function concatenates the `:class:` option directly