@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.13.0) +137 more potentially affected by CVE-2026-59880 via immutable (>=5.0.0, <=5.1.6)

immutable NPM version =5.0.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =9.1.1-ruixiang.1, =0.1.0, =1.0.6 and more Source cves: CVE-2026-59880 Source advisory: OSV:GHSA-XVCM-6775-5M9R...

Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Summary Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the keys inserted into a Map can craft many keys that all collide, degrading insertion and...

GHSA-XVCM-6775-5M9R Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Summary Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the keys inserted into a Map can craft many keys that all collide, degrading insertion and...

EUVD-2026-42315

Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set...

NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set vulnerability discovered by ? in WordPress Npm immutable versions 4.3.9...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +655 more potentially affected by CVE-2026-59880 via immutable (>=4.0.0, <=4.3.8)

immutable NPM version =4.0.0, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-59880 Source advisory: OSV:GHSA-XVCM-6775-5M9R...

-graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2), 01-test-button (>=1.0.0, <=1.0.2) +11004 more potentially affected by CVE-2026-59880 via immutable (>=3.0.1, <=3.8.3)

immutable NPM version =3.0.1, =2.0.1, =1.0.0, =0.0.2, =0.2.0, =2.0.0-rc3, =1.0.0, =1.0.0, =0.1.0, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2026-59880 Source advisory: OSV:GHSA-XVCM-6775-5M9R...

-graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2), 01-test-button (>=1.0.0, <=1.0.2) +11004 more potentially affected by CVE-2026-59879 via immutable (>=3.0.1, <=3.8.3)

immutable NPM version =3.0.1, =2.0.1, =1.0.0, =0.0.2, =0.2.0, =2.0.0-rc3, =1.0.0, =1.0.0, =0.1.0, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2026-59879 Source advisory: OSV:GHSA-V56Q-MH7H-F735...

GHSA-V56Q-MH7H-F735 Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

Summary Listset, ListsetSize, ListsetIn, ListupdateIn and the functional set / setIn / updateIn mishandle an index or size in the range 2 30, 2 31: - On an empty List the operation enters an uncatchable infinite loop a tight CPU spin; a surrounding try/catch never regains control. Only killing th...

@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.13.0) +137 more potentially affected by CVE-2026-59879 via immutable (>=5.0.0, <=5.1.6)

immutable NPM version =5.0.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =9.1.1-ruixiang.1, =0.1.0, =1.0.6 and more Source cves: CVE-2026-59879 Source advisory: OSV:GHSA-V56Q-MH7H-F735...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +655 more potentially affected by CVE-2026-59879 via immutable (>=4.0.0, <=4.3.8)

immutable NPM version =4.0.0, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-59879 Source advisory: OSV:GHSA-V56Q-MH7H-F735...

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

Summary Listset, ListsetSize, ListsetIn, ListupdateIn and the functional set / setIn / updateIn mishandle an index or size in the range 2 30, 2 31: - On an empty List the operation enters an uncatchable infinite loop a tight CPU spin; a surrounding try/catch never regains control. Only killing th...

EUVD-2026-44354

Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability...

ROS-20260721-73-0026

The vulnerability of the “Network” control element in Google Chrome and Microsoft Edge relates to external control over a web parameter that is assumed to be immutable. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms through a specially created HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-59880

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

CVE-2026-63745

SurrealDB prior to 3.1.0 contains an authorization bypass in which authenticated users can spoof composite record-id field values by writing to editable body fields. This allows bypassing permission checks that gate access on id components (e.g., tenant isolation) by setting same-named body field...

SUSE-SU-2026:22763-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...