{"cves":[{"id":"CVE-2026-54280","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:58:09.337408+00:00","description":"\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and\nPython. Prior to 3.14.1, payload resources are not closed correctly when a\nclient disconnects in the middle of a write. If a payload is using an open\nfile or similar limited resource, then an attacker may be able to cause\nresource starvation temporarily until garbage collection or similar closes\nthe file. This vulnerability is fixed in 3.14.1.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":1.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-54280","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9"],"bugs":[""],"patches":{"python-aiohttp":[]},"tags":{},"packages":[{"name":"python-aiohttp","source":"https://ubuntu.com/security/cve?package=python-aiohttp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-aiohttp","debian":"https://tracker.debian.org/pkg/python-aiohttp","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.14.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-54279","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:58:09.337408+00:00","description":"\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and\nPython. Prior to 3.14.1, host-only cookies that are saved with\nCookieJar.save() and then restored later with CookieJar.load() lose their\nhost-only status. This vulnerability is fixed in 3.14.1.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":1.3,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-54279","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8"],"bugs":[""],"patches":{"python-aiohttp":[]},"tags":{},"packages":[{"name":"python-aiohttp","source":"https://ubuntu.com/security/cve?package=python-aiohttp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-aiohttp","debian":"https://tracker.debian.org/pkg/python-aiohttp","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.14.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-54278","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:58:09.337408+00:00","description":"\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and\nPython. Prior to 3.14.1, during cleanup it is possible for a compressed\nrequest body to be decompressed into memory in one chunk. An attacker may\nbe able to send a compressed payload in specific situations that could be\ndecompressed into memory, potentially leading to DoS (a zip bomb edge\ncase). This vulnerability is fixed in 3.14.1.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":6.6,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-54278","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74"],"bugs":[""],"patches":{"python-aiohttp":[]},"tags":{},"packages":[{"name":"python-aiohttp","source":"https://ubuntu.com/security/cve?package=python-aiohttp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-aiohttp","debian":"https://tracker.debian.org/pkg/python-aiohttp","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.14.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-54277","published":"2026-06-22T18:16:00","updated_at":"2026-07-01T23:25:36.531333+00:00","description":"\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and\nPython. Prior to 3.14.1, it is possible to bypass the max_line_size check\nin parts of an HTTP request in the C parser. If using the optimised C\nparser (the default in pre-built wheels), then an attacker may be able to\nsend oversized lines through the HTTP parser and use an excessive amount of\nmemory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":6.6,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-54277","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2"],"bugs":[""],"patches":{"python-aiohttp":[]},"tags":{},"packages":[{"name":"python-aiohttp","source":"https://ubuntu.com/security/cve?package=python-aiohttp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-aiohttp","debian":"https://tracker.debian.org/pkg/python-aiohttp","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.14.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-54276","published":"2026-06-22T18:16:00","updated_at":"2026-07-01T23:25:36.531333+00:00","description":"\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and\nPython. Prior to 3.14.1, DigestAuthMiddleware can send an authentication\nresponse after following a cross-origin redirect. This likely requires an\nopen redirect vulnerability or similar on the target domain for an attacker\nto be able to execute. Further, the attacker is only receiving the digest,\nso should only be able to extract the user's credentials if the\ncryptography is weak or there is some kind of password reuse. This\nvulnerability is fixed in 3.14.1.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":6.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-54276","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp"],"bugs":[""],"patches":{"python-aiohttp":[]},"tags":{},"packages":[{"name":"python-aiohttp","source":"https://ubuntu.com/security/cve?package=python-aiohttp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-aiohttp","debian":"https://tracker.debian.org/pkg/python-aiohttp","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.14.1-1","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-54275","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:58:09.337408+00:00","description":"\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and\nPython. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed\nwhen an existing connection is reused. If an application makes multiple\nrequests to the same domain, but with different per-request server_hostname\nparameters, then the later calls may succeed by reusing the existing\nconnection when they should have been rejected due to the TLS SNI check.\nThis vulnerability is fixed in 3.14.1.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":2.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-54275","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"],"bugs":[""],"patches":{"python-aiohttp":[]},"tags":{},"packages":[{"name":"python-aiohttp","source":"https://ubuntu.com/security/cve?package=python-aiohttp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-aiohttp","debian":"https://tracker.debian.org/pkg/python-aiohttp","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.14.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-54274","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:58:09.337408+00:00","description":"\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and\nPython. Prior to 3.14.1, if an attacker sends large incomplete websocket\nframe payloads, it may be possible to bypass the usual size limits on\nmemory use. This vulnerability is fixed in 3.14.1.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":6.6,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-54274","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989"],"bugs":[""],"patches":{"python-aiohttp":[]},"tags":{},"packages":[{"name":"python-aiohttp","source":"https://ubuntu.com/security/cve?package=python-aiohttp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-aiohttp","debian":"https://tracker.debian.org/pkg/python-aiohttp","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.14.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-54273","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:58:09.337408+00:00","description":"\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and\nPython. Prior to 3.14.1, no limit was present on the number of pipelined\nrequests that could be queued. An attacker may be able to use pipelined\nrequests to use excessive amounts of memory, potentially leading to DoS.\nThis vulnerability is fixed in 3.14.1.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":6.6,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-54273","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc"],"bugs":[""],"patches":{"python-aiohttp":[]},"tags":{},"packages":[{"name":"python-aiohttp","source":"https://ubuntu.com/security/cve?package=python-aiohttp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-aiohttp","debian":"https://tracker.debian.org/pkg/python-aiohttp","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.14.1-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-53540","published":"2026-06-22T18:16:00","updated_at":"2026-06-26T01:40:11.783608+00:00","description":"\nPython-Multipart is a streaming multipart parser for Python. Prior to\n0.0.31, parse_form() did not validate the Content-Length header before\nusing it to bound its chunked read of the request body. A negative\nContent-Length turned the bounded read into a read-until-EOF, so the entire\nbody was loaded into memory in a single read instead of in fixed-size\nchunks. This vulnerability is fixed in 0.0.31.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-53540"],"bugs":[""],"patches":{"python-multipart":[]},"tags":{},"packages":[{"name":"python-multipart","source":"https://ubuntu.com/security/cve?package=python-multipart","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-multipart","debian":"https://tracker.debian.org/pkg/python-multipart","statuses":[{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-53539","published":"2026-06-22T18:16:00","updated_at":"2026-06-26T01:40:11.783608+00:00","description":"\nPython-Multipart is a streaming multipart parser for Python. Prior to\n0.0.30, when parsing application/x-www-form-urlencoded bodies,\nQuerystringParser located the field separator with a two step lookup: it\nfirst scanned the entire remaining buffer for &, and only when no & existed\nanywhere ahead did it fall back to scanning for ;. For a body that uses ;\nas the separator and contains no &, every field iteration performed a full\nfailed & scan over the entire remaining buffer before locating the nearby\n;. With N semicolon separated fields in a chunk of size B, this yields\nO(B^2) byte comparisons per chunk. An attacker can submit a small crafted\nbody of the form a;a;a;... and cause the parser to spend seconds of CPU per\nrequest. A handful of concurrent requests can exhaust worker processes.\nThis vulnerability is fixed in 0.0.30.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-53539"],"bugs":[""],"patches":{"python-multipart":[]},"tags":{},"packages":[{"name":"python-multipart","source":"https://ubuntu.com/security/cve?package=python-multipart","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-multipart","debian":"https://tracker.debian.org/pkg/python-multipart","statuses":[{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-53538","published":"2026-06-22T18:16:00","updated_at":"2026-06-26T01:40:11.783608+00:00","description":"\nPython-Multipart is a streaming multipart parser for Python. Prior to\n0.0.30, QuerystringParser treated ; as a field separator in\napplication/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL\nstandard, modern browsers, and Python's urllib.parse (since the\nCVE-2021-23336 fix) treat only & as a separator. This creates a parser\ndifferential: the same bytes are tokenized into different fields than a\nWHATWG compliant intermediary would produce, allowing an attacker to\nsmuggle extra form fields past an upstream body inspecting component. This\nvulnerability is fixed in 0.0.30.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-53538"],"bugs":[""],"patches":{"python-multipart":[]},"tags":{},"packages":[{"name":"python-multipart","source":"https://ubuntu.com/security/cve?package=python-multipart","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-multipart","debian":"https://tracker.debian.org/pkg/python-multipart","statuses":[{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-53537","published":"2026-06-22T18:16:00","updated_at":"2026-06-26T01:40:11.783608+00:00","description":"\nPython-Multipart is a streaming multipart parser for Python. Prior to\n0.0.30, parse_options_header parsed Content-Disposition (and Content-Type)\nheaders with email.message.Message, which transparently applies RFC\n2231/5987 decoding. The extended parameter syntax\n(filename*=charset'lang'value, name*=..., and the filename*0/filename*1\ncontinuation form) is decoded and surfaced under the bare filename/name\nkey, and overrides the plain parameter when both are present. RFC 7578 §4.2\nexplicitly forbids the filename* form in multipart/form-data. Components\nthat follow RFC 7578, or that do not implement RFC 2231/5987 decoding for\nmultipart/form-data (WAFs, proxies, gateways), may interpret such a header\ndifferently. An attacker can exploit that difference to smuggle a different\nfield name or filename past an upstream inspector to the backend. This\nvulnerability is fixed in 0.0.30.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.7,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-53537"],"bugs":[""],"patches":{"python-multipart":[]},"tags":{},"packages":[{"name":"python-multipart","source":"https://ubuntu.com/security/cve?package=python-multipart","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-multipart","debian":"https://tracker.debian.org/pkg/python-multipart","statuses":[{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-50556","published":"2026-06-22T18:16:00","updated_at":"2026-06-30T18:51:46.169013+00:00","description":"\nAngular is a development platform for building mobile and desktop web\napplications using TypeScript/JavaScript and other languages. Prior to\n22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS)\nvulnerability exists in @angular/platform-server's DOM emulation dependency\n(domino) when serializing the content of <noscript> elements. When\nrendering dynamic text content inside a <noscript> element via template\nbindings (such as {{ value }} or [textContent]), the template engine\nexpects the browser to render the content safely. Under Server-Side\nRendering (SSR), domino is configured with scripting enabled, meaning\n<noscript> is treated as a raw-text element. However, domino's serializer\ncompletely omitted <noscript> from the list of raw-text elements requiring\nclosing-tag escaping during DOM serialization. As a result, any occurrence\nof </noscript> in the bound dynamic text was never escaped under any\ncircumstances. The unescaped closing tag was serialized directly into the\noutput HTML (e.g.\n<noscript></noscript><script>alert(1)</script></noscript>). When parsed by\na browser, it closes the <noscript> block early, allowing the injected\n<script> block to execute in the user's browser context, causing\nsame-origin Cross-Site Scripting (XSS). This vulnerability is fixed in\n22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.6,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-50556"],"bugs":[""],"patches":{"angular.js":[]},"tags":{},"packages":[{"name":"angular.js","source":"https://ubuntu.com/security/cve?package=angular.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=angular.js","debian":"https://tracker.debian.org/pkg/angular.js","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-50555","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:57:26.651336+00:00","description":"\nAngular is a development platform for building mobile and desktop web\napplications using TypeScript/JavaScript and other languages. Prior to\n22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25, a Cross-Site Scripting (XSS)\nvulnerability exists in @angular/platform-server's DOM emulation dependency\n(domino) when serializing the content of raw-text elements (such as\n<script>, <style>, and <iframe>). domino supports escaping raw-text\nelements during serialization to prevent closing-tag breakout. However, a\nUnicode index alignment bug existed in this escaping logic. In JavaScript,\nstring lengths and character indices are calculated based on UTF-16 code\nunits (where astral characters—such as emojis—occupy 2 code units / 4\nbytes). If the bound dynamic text contained astral Unicode characters\nbefore the closing tag (e.g. </script>, </style>, or </iframe>), the index\noffset calculation in domino's replacement logic shifted. This misalignment\ncaused domino to fail to replace or escape the closing tag, leaving it raw\nand unescaped in the output HTML. An attacker who controls the dynamic text\ncan supply a payload containing both an astral Unicode character and a\nclosing tag (e.g., 😀</iframe><script>alert(1)</script>). When serialized on\nthe server during SSR, the browser parses the unescaped closing tag, exits\nthe raw-text context early, and executes the subsequent <script> block,\nleading to same-origin Cross-Site Scripting (XSS). This vulnerability is\nfixed in 22.0.0-rc.2, 21.2.16, 20.3.24, and 19.2.25.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.6,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-50555"],"bugs":[""],"patches":{"angular.js":[]},"tags":{},"packages":[{"name":"angular.js","source":"https://ubuntu.com/security/cve?package=angular.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=angular.js","debian":"https://tracker.debian.org/pkg/angular.js","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-50269","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:57:26.651336+00:00","description":"\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and\nPython. Prior to 3.14.0, attacker-controlled input included into\nmultipart/payload headers can be used to modify a request to inject\nadditional headers or similar. In the unlikely situation that an\napplication is passing user-controlled strings into\nMultipartWriter.append(headers=...) or Payload.headers, then an attacker\nmay be able to modify the request to inject headers or change the contents\nof the request. This vulnerability is fixed in 3.14.0.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":2.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-50269","https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m"],"bugs":[""],"patches":{"python-aiohttp":[]},"tags":{},"packages":[{"name":"python-aiohttp","source":"https://ubuntu.com/security/cve?package=python-aiohttp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=python-aiohttp","debian":"https://tracker.debian.org/pkg/python-aiohttp","statuses":[{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"3.14.0-1","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-50184","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:57:26.651336+00:00","description":"\nAngular is a development platform for building mobile and desktop web\napplications using TypeScript/JavaScript and other languages. Prior to\n22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the\n@angular/service-worker package compromises the integrity of request-policy\nenforcement during request reconstruction. When the Angular Service Worker\nintercepts network requests for matched assets, it reconstructs a new\nRequest object using an internal helper function. During this\nreconstruction process, the helper function strips explicit client-defined\nsafety parameters: the credentials configuration (such as credentials:\n'omit') and the HTTP cache mode configuration (such as cache: 'no-store').\nThese are reverted back to standard browser-default parameters\n(credentials: 'same-origin' and default HTTP cache properties). This causes\nthe browser to include active credentials (such as cookies or Authorization\nheaders) on outbound requests where the client-side developer explicitly\ninstructed they should be omitted, leading to potential session leaks.\nAdditionally, it causes private or non-cacheable resources to be cached by\nthe service worker's engine, making private page states accessible or\npersistent inside the client's local cache post-logout. This vulnerability\nis fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":5.7,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-50184"],"bugs":[""],"patches":{"angular.js":[]},"tags":{},"packages":[{"name":"angular.js","source":"https://ubuntu.com/security/cve?package=angular.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=angular.js","debian":"https://tracker.debian.org/pkg/angular.js","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-50171","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:57:26.651336+00:00","description":"\nAngular is a development platform for building mobile and desktop web\napplications using TypeScript/JavaScript and other languages. Prior to\n22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS)\nvulnerability exists in the @angular/common package of Angular. The\nformatNumber function, which is also utilized by DecimalPipe, PercentPipe,\nand CurrencyPipe, does not properly validate the upper bounds of the\ndigitsInfo parameter. Specifically, the minimum and maximum fraction digits\nparsed from the digitsInfo string (e.g., 1.2-4) are converted to integers\nand used without limits. When parsing a maliciously crafted digitsInfo\nstring with excessively large fraction digit values (e.g.,\n1.200000000-200000000), the internal roundNumber function attempts to pad\nthe digits array to match the requested fraction size. This results in an\nunbounded loop that repeatedly pushes elements into an array.  This\nvulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.2,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-50171"],"bugs":[""],"patches":{"angular.js":[]},"tags":{},"packages":[{"name":"angular.js","source":"https://ubuntu.com/security/cve?package=angular.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=angular.js","debian":"https://tracker.debian.org/pkg/angular.js","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-50170","published":"2026-06-22T18:16:00","updated_at":"2026-07-01T23:25:11.795799+00:00","description":"\nAngular is a development platform for building mobile and desktop web\napplications using TypeScript/JavaScript and other languages. Prior to\n22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered\nin @angular/common when Server-Side Rendering (SSR) and hydration are\nenabled. The HttpTransferCache utility optimizes hydration by caching\noutgoing HTTP requests performed during SSR and transferring the cached\nstate to the client-side application via TransferState. However, the\ncaching mechanism fails to inspect the withCredentials flag or the Cookie\nheader of outgoing requests. As a result, credentialed, user-specific\nresponses may be cached by default in the shared TransferState payload.\nWhen these responses are serialized into the HTML, any caching layer (such\nas a CDN, reverse proxy, or shared server cache) that caches the\nSSR-rendered HTML page could inadvertently cache and leak one user's\nprivate data to other users, leading to a high-severity information\ndisclosure vulnerability. This vulnerability is fixed in 22.0.0-rc.2,\n21.2.15, 20.3.22, and 19.2.23.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.2,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-50170"],"bugs":[""],"patches":{"angular.js":[]},"tags":{},"packages":[{"name":"angular.js","source":"https://ubuntu.com/security/cve?package=angular.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=angular.js","debian":"https://tracker.debian.org/pkg/angular.js","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-50169","published":"2026-06-22T18:16:00","updated_at":"2026-06-29T05:57:26.651336+00:00","description":"\nAngular is a development platform for building mobile and desktop web\napplications using TypeScript/JavaScript and other languages. Prior to\n22.0.0-rc.2, 21.2.15 20.3.22, and 19.2.23, an issue in the\n@angular/service-worker package compromises the integrity of request-policy\nenforcement during request reconstruction. When the Angular Service Worker\nintercepts network requests for matched assets, it reconstructs a new\nRequest object using an internal helper function. During this\nreconstruction process, the helper function strips the strict,\nclient-defined request redirect policy configuration (such as redirect:\n'error'), falling back to the browser's default 'follow' strategy. If the\ntarget web application makes client-side requests with a strict policy\n(e.g., expecting a network error instead of automatically following\nredirects), the service worker will bypass this instruction and\nautomatically follow HTTP 3xx redirects to other destinations. This acts as\nan unintended proxy/intermediary (\"Confused Deputy\") and can result in\ncookie/credential exposure or same-origin session-restricted data leakage\nif public dynamic routes redirect to sensitive routes. This vulnerability\nis fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":5.7,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-50169"],"bugs":[""],"patches":{"angular.js":[]},"tags":{},"packages":[{"name":"angular.js","source":"https://ubuntu.com/security/cve?package=angular.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=angular.js","debian":"https://tracker.debian.org/pkg/angular.js","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-50168","published":"2026-06-22T18:16:00","updated_at":"2026-07-01T23:25:11.795799+00:00","description":"\nAngular is a development platform for building mobile and desktop web\napplications using TypeScript/JavaScript and other languages. Prior to\n22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the\n@angular/platform-server package allows remote attackers to bypass host\nallowlist constraints and direct server-side outgoing requests to arbitrary\nexternal endpoints. This occurs due to a parser differential between the\nstrict WHATWG URL parser used for allowlist validation and the lenient\nDomino URL parser used to initialize the server emulated DOM. When a\nserver-side request contains a malformed URL with a double port structure\n(e.g., http://evil.com:80:80/path), Node's strict URL.canParse(url) logic\nreturns false and skips host check validation entirely. However, the same\nmalformed URL is later accepted and parsed leniently by Domino's internal\nparser, which resolves the origin to http://evil.com:80. The Angular SSR\nHTTP request interceptor (relativeUrlsTransformerInterceptorFn) then\nresolves all relative backend HTTP requests against this adopted origin,\nexecuting the SSRF attack. This vulnerability is fixed in 22.0.0-rc.2,\n21.2.15, 20.3.22, and 19.2.23.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.2,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.8,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-50168"],"bugs":[""],"patches":{"angular.js":[]},"tags":{},"packages":[{"name":"angular.js","source":"https://ubuntu.com/security/cve?package=angular.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=angular.js","debian":"https://tracker.debian.org/pkg/angular.js","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":9380,"limit":20,"total_results":79316}