GHSA-fx5j-qcqg-grpfPublished
Excelize: Negative shared-string index causes panic in GetCellValue and GetRows
osv · CVE-2026-59162 · GO-2026-6452
Go: github.com/xuri/excelize/v2 · Go: github.com/xuri/excelize
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699309 source statements · aliases may refer to the same vulnerabilityGHSA-7jxh-36q5-gcqvPublished
containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service
osv · CVE-2026-53495 · GO-2026-6444
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
GHSA-v67p-phpq-fc8xPublished
Traefik entrypoint header-name sanitization bypassed via request trailers
osv · CVE-2026-88004 · GO-2026-6467
Go: github.com/traefik/traefik/v3
GHSA-c476-6w5q-jw77Published
rclone: FTP cross-session auth-proxy backend confusion
osv · BIT-rclone-2026-88017 · CVE-2026-88017 · GO-2026-6458
Go: github.com/rclone/rclone
GO-2026-6458Published
rclone: FTP cross-session auth-proxy backend confusion in github.com/rclone/rclone
osv · BIT-rclone-2026-88017 · CVE-2026-88017 · GHSA-c476-6w5q-jw77
Go: github.com/rclone/rclone
GHSA-vrh8-c9cm-wh8vPublished
ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange
osv · CVE-2026-56668 · GO-2026-6474
Go: github.com/zitadel/zitadel
GHSA-g8rh-fjm6-h2h9Published
LF Edge eKuiper: Self-XSS in External Service Creation
osv · CVE-2025-24978 · GO-2026-6446
Go: github.com/lf-edge/ekuiper/v2
GHSA-f52w-8j3h-j724Published
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
osv · CVE-2026-88009 · GO-2026-6465
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v2
GHSA-c23q-fw86-9h5xPublished
LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint
osv · CVE-2025-58363 · GO-2026-6445
Go: github.com/lf-edge/ekuiper/v2
GHSA-qqjf-53cj-pwvvPublished
Traefik HTTP/3 Backend NTLM Connection Reuse
osv · CVE-2026-88007 · GO-2026-6466
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v2
GHSA-7ghq-v6jf-g56cPublished
Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded
osv · CVE-2026-88012 · CVE-2026-88878 · GO-2026-6454
Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GO-2026-6454Published
Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded in github.com/traefik/traefik
osv · CVE-2026-88012 · CVE-2026-88878 · GHSA-7ghq-v6jf-g56c
Go: github.com/traefik/traefik · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GHSA-w4v4-9rw7-5326Published
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
osv · CVE-2026-88008 · GO-2026-6468
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v2
GHSA-q5j5-6p94-4gwcPublished
Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation
osv · CVE-2026-59161 · GO-2026-6453
Go: github.com/xuri/excelize/v2 · Go: github.com/xuri/excelize
GHSA-rf44-j88r-hh8cPublished
Traefik: ForwardAuth identity spoofing via dot-form header alias
osv · CVE-2026-88011 · CVE-2026-88879 · GO-2026-6455
Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GO-2026-6455Published
Traefik: ForwardAuth identity spoofing via dot-form header alias in github.com/traefik/traefik
osv · CVE-2026-88011 · CVE-2026-88879 · GHSA-rf44-j88r-hh8c
Go: github.com/traefik/traefik · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GHSA-v25g-mvwr-f5fpPublished
webhookd: Unrestricted HTTP Header to Shell Variable Injection
osv · CVE-2026-59157 · GO-2026-6451
Go: github.com/ncarlier/webhookd
GHSA-pqqc-8v73-9gg2Published
LF Edge eKuiper: SSRF in External Service
osv · CVE-2025-24979 · GO-2026-6447
Go: github.com/lf-edge/ekuiper/v2
CVE-2026-16588Published
WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter
cve-program ·
Vendor product: WP Directory Kit
CVE-2026-89063Published
Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
cve-program ·
Vendor product: Online Scheduling and Appointment Booking System – Bookly
CVE-2026-19666Published
Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path
cve-program ·
Vendor product: BIND 9
CVE-2026-76163Published
named aborts on a TKEY query when the user configuration has no global options statement
cve-program ·
Vendor product: BIND 9
CVE-2026-80274Published
Validating resolver can abort while caching a mismatched NOQNAME proof
cve-program ·
Vendor product: BIND 9
CVE-2026-19033Published
Unauthenticated IXFR deltas are applied to the live zone before TSIG verification
cve-program ·
Vendor product: BIND 9
CVE-2026-92625Published
Control iD iDSecure Unauthenticated Denial of Service
cve-program ·
Vendor product: iDSecure
CVE-2026-92626Published
Control iD iDSecure Unauthenticated Denial of Service
cve-program ·
Vendor product: iDSecure
CVE-2026-85385Published
Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-85386Published
Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-87028Published
Cross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-87031Published
Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-85387Published
Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-18120Published
Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
GO-2026-6473Published
ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions in github.com/zitadel/zitadel
osv · CVE-2026-76081 · GHSA-v859-c572-qh5p
Go: github.com/zitadel/zitadel
GO-2026-6469Published
ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider in github.com/zitadel/zitadel
osv · CVE-2026-56665 · GHSA-v77h-2w3m-94hx
Go: github.com/zitadel/zitadel
GO-2026-6474Published
ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange in github.com/zitadel/zitadel
osv · CVE-2026-56668 · GHSA-vrh8-c9cm-wh8v
Go: github.com/zitadel/zitadel
GO-2026-6470Published
ZITADEL: Auto-linking by email: IdP-side email verification is not checked in github.com/zitadel/zitadel
osv · CVE-2026-56666 · GHSA-992q-9gwp-7r79
Go: github.com/zitadel/zitadel
GO-2026-6466Published
Traefik HTTP/3 Backend NTLM Connection Reuse in github.com/traefik/traefik
osv · CVE-2026-88007 · GHSA-qqjf-53cj-pwvv
Go: github.com/traefik/traefik · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GO-2026-6450Published
Joker linter executed project-local .jokerd/linter.* files during linting in github.com/candid82/joker
osv · CVE-2026-59172 · GHSA-m835-3cm9-rggg
Go: github.com/candid82/joker
GO-2026-6449Published
Komari: Management Interface CSRF in github.com/komari-monitor/komari
osv · GHSA-hxjg-93wc-h8p8
Go: github.com/komari-monitor/komari
GO-2026-6467Published
Traefik entrypoint header-name sanitization bypassed via request trailers in github.com/traefik/traefik
osv · CVE-2026-88004 · GHSA-v67p-phpq-fc8x
Go: github.com/traefik/traefik · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GO-2026-6468Published
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization in github.com/traefik/traefik
osv · CVE-2026-88008 · GHSA-w4v4-9rw7-5326
Go: github.com/traefik/traefik · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GO-2026-6465Published
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging in github.com/traefik/traefik
osv · CVE-2026-88009 · GHSA-f52w-8j3h-j724
Go: github.com/traefik/traefik · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik/v3
GO-2026-6451Published
webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd
osv · CVE-2026-59157 · GHSA-v25g-mvwr-f5fp
Go: github.com/ncarlier/webhookd
GO-2026-6446Published
LF Edge eKuiper: Self-XSS in External Service Creation in github.com/lf-edge/ekuiper
osv · CVE-2025-24978 · GHSA-g8rh-fjm6-h2h9
Go: github.com/lf-edge/ekuiper · Go: github.com/lf-edge/ekuiper/v2
GO-2026-6445Published
LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint in github.com/lf-edge/ekuiper
osv · CVE-2025-58363 · GHSA-c23q-fw86-9h5x
Go: github.com/lf-edge/ekuiper · Go: github.com/lf-edge/ekuiper/v2
GO-2026-6447Published
LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper
osv · CVE-2025-24979 · GHSA-pqqc-8v73-9gg2
Go: github.com/lf-edge/ekuiper · Go: github.com/lf-edge/ekuiper/v2
GO-2026-6448Published
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail
osv · CVE-2026-59185 · GHSA-cp3j-m783-3ph5
Go: github.com/identrail/identrail
GO-2026-6444Published
containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd
osv · CVE-2026-53495 · GHSA-7jxh-36q5-gcqv
Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.