CVE-2026-62239Published
FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py
cve-program ·
Vendor product: flash-attention
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699291 source statements · aliases may refer to the same vulnerabilityCVE-2026-59712Published
Leantime - JSON-RPC API Broken Access Control via users.getUser
cve-program ·
Vendor product: Leantime
CVE-2026-56336Published
Capgo - Information Disclosure via Unauthenticated SSO check-domain Endpoint
cve-program ·
Vendor product: Capgo
CVE-2026-56281Published
Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
cve-program ·
Vendor product: Capgo
CVE-2026-56223Published
Capgo - Account Takeover via Cross-Domain SSO Email Assertion in provision-user
cve-program ·
Vendor product: Capgo
CVE-2026-53822Published
OpenClaw < 2026.5.18 - Command Argument Modification via Shell Wrapper Between Approval and Execution
cve-program ·
Vendor product: OpenClaw
CVE-2026-32896Published
OpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin
cve-program ·
Vendor product: OpenClaw
CVE-2026-28474Published
OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofing
cve-program ·
Vendor product: nextcloud-talk
CVE-2026-81563Published
SVCB AliasMode additional-data error leaks qpcache references
cve-program ·
Vendor product: BIND 9
CVE-2026-79042Published
Missing authorization in Payments in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via a crafted HTML page. (Chromium security sev…
cve-program ·
Vendor product: Chrome
GHSA-c3gv-825q-fvmpPublished
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID
osv · CVE-2026-86038
npm: @libp2p/gossipsub
CVE-2026-44235Published
rabbitmq-c: size_t underflow in AMQP frame length computation leads to out-of-bounds read
cve-program ·
Vendor product: rabbitmq-c
CVE-2026-54546Published
CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
cve-program ·
Vendor product: CloudTAK
GHSA-hxjg-93wc-h8p8Published
Komari: Management Interface CSRF
osv · GO-2026-6449
Go: github.com/komari-monitor/komari
GHSA-xwwr-4h3p-r22cPublished
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
osv · BIT-rclone-2026-88018 · CVE-2026-88018 · GO-2026-6462
Go: github.com/rclone/rclone
GO-2026-6462Published
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone
osv · BIT-rclone-2026-88018 · CVE-2026-88018 · GHSA-xwwr-4h3p-r22c
Go: github.com/rclone/rclone
GHSA-v859-c572-qh5pPublished
ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions
osv · CVE-2026-76081 · GO-2026-6473
Go: github.com/zitadel/zitadel
GHSA-m835-3cm9-rgggPublished
Joker linter executed project-local .jokerd/linter.* files during linting
osv · CVE-2026-59172 · GO-2026-6450
Go: github.com/candid82/joker
GO-2026-6459Published
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination in github.com/rclone/rclone
osv · BIT-rclone-2026-88016 · CVE-2026-88016 · GHSA-f8g7-2xjc-7mfh
Go: github.com/rclone/rclone
GHSA-cp3j-m783-3ph5Published
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
osv · CVE-2026-59185 · GO-2026-6448
Go: github.com/identrail/identrail
GHSA-v77h-2w3m-94hxPublished
ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
osv · CVE-2026-56665 · GO-2026-6469
Go: github.com/zitadel/zitadel · Go: github.com/zitadel/zitadel
GHSA-992q-9gwp-7r79Published
ZITADEL: Auto-linking by email: IdP-side email verification is not checked
osv · CVE-2026-56666 · GO-2026-6470
Go: github.com/zitadel/zitadel
GHSA-fx5j-qcqg-grpfPublished
Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
osv · CVE-2026-59162 · GO-2026-6452
Go: github.com/xuri/excelize/v2 · Go: github.com/xuri/excelize
GHSA-7jxh-36q5-gcqvPublished
containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service
osv · CVE-2026-53495 · GO-2026-6444
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
GHSA-v67p-phpq-fc8xPublished
Traefik entrypoint header-name sanitization bypassed via request trailers
osv · CVE-2026-88004 · GO-2026-6467
Go: github.com/traefik/traefik/v3
GHSA-c476-6w5q-jw77Published
rclone: FTP cross-session auth-proxy backend confusion
osv · BIT-rclone-2026-88017 · CVE-2026-88017 · GO-2026-6458
Go: github.com/rclone/rclone
GO-2026-6458Published
rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone
osv · BIT-rclone-2026-88017 · CVE-2026-88017 · GHSA-c476-6w5q-jw77
Go: github.com/rclone/rclone
GHSA-vrh8-c9cm-wh8vPublished
ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
osv · CVE-2026-56668 · GO-2026-6474
Go: github.com/zitadel/zitadel
GHSA-g8rh-fjm6-h2h9Published
LF Edge eKuiper: Self-XSS in External Service Creation
osv · CVE-2025-24978 · GO-2026-6446
Go: github.com/lf-edge/ekuiper/v2
GHSA-f52w-8j3h-j724Published
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
osv · CVE-2026-88009 · GO-2026-6465
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v2
GHSA-c23q-fw86-9h5xPublished
LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint
osv · CVE-2025-58363 · GO-2026-6445
Go: github.com/lf-edge/ekuiper/v2
GHSA-qqjf-53cj-pwvvPublished
Traefik HTTP/3 Backend NTLM Connection Reuse
osv · CVE-2026-88007 · GO-2026-6466
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v2
GHSA-7ghq-v6jf-g56cPublished
Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
osv · CVE-2026-88012 · CVE-2026-88878 · GO-2026-6454
Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GO-2026-6454Published
Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik
osv · CVE-2026-88012 · CVE-2026-88878 · GHSA-7ghq-v6jf-g56c
Go: github.com/traefik/traefik · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GHSA-w4v4-9rw7-5326Published
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
osv · CVE-2026-88008 · GO-2026-6468
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v2
GHSA-q5j5-6p94-4gwcPublished
Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
osv · CVE-2026-59161 · GO-2026-6453
Go: github.com/xuri/excelize/v2 · Go: github.com/xuri/excelize
GHSA-rf44-j88r-hh8cPublished
Traefik: ForwardAuth identity spoofing via dot-form header alias
osv · CVE-2026-88011 · CVE-2026-88879 · GO-2026-6455
Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GO-2026-6455Published
Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik
osv · CVE-2026-88011 · CVE-2026-88879 · GHSA-rf44-j88r-hh8c
Go: github.com/traefik/traefik · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GHSA-v25g-mvwr-f5fpPublished
webhookd: Unrestricted HTTP Header to Shell Variable Injection
osv · CVE-2026-59157 · GO-2026-6451
Go: github.com/ncarlier/webhookd
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.