NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

NPM: Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set vulnerability discovered by ? in WordPress Npm immutable versions 4.3.9...

GHSA-XVCM-6775-5M9R Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Summary Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the keys inserted into a Map can craft many keys that all collide, degrading insertion and...

EUVD-2026-42315

Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set...

Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set

Summary Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a collision bucket that is scanned linearly. The string hash is public and deterministic, so an attacker who controls the keys inserted into a Map can craft many keys that all collide, degrading insertion and...

GHSA-V56Q-MH7H-F735 Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

Summary Listset, ListsetSize, ListsetIn, ListupdateIn and the functional set / setIn / updateIn mishandle an index or size in the range 2 30, 2 31: - On an empty List the operation enters an uncatchable infinite loop a tight CPU spin; a surrounding try/catch never regains control. Only killing th...

EUVD-2026-44354

Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege Vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2026-59880

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

CVE-2026-63745

SurrealDB prior to 3.1.0 contains an authorization bypass in which authenticated users can spoof composite record-id field values by writing to editable body fields. This allows bypassing permission checks that gate access on id components (e.g., tenant isolation) by setting same-named body field...

SUSE-SU-2026:22763-1 Security update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 16)

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues The following security issues were fixed: - CVE-2026-31505: iavf: fix out-of-bounds writes in iavfgetethtoolstats bsc1263094. - CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

SUSE-SU-2026:22679-1 Security update for the Linux Kernel (Live Patch 23 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-46.1 fixes various security issues The following security issues were fixed: - CVE-2026-43501: ipv6: rpl: reserve maclen headroom when recompressed SRH grows bsc1266015. - CVE-2026-45970: bonding: alb: fix UAF in rlbarprecv during bond up/dow...