GO-2026-6363Published
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection in github.com/axllent/mailpit
osv · CVE-2026-67445 · GHSA-w878-pj84-3j5v
Go: github.com/axllent/mailpit
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700896 source statements · aliases may refer to the same vulnerabilityGO-2026-6400Published
SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode) in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-72810 · GHSA-mw8r-mw84-88v2
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6377Published
SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-69084 · GHSA-vh22-h7hf-www7
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6411Published
MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox
osv · CVE-2026-11720 · GHSA-vwxw-jrg6-9jxv
Go: github.com/googleapis/mcp-toolbox
GO-2026-6374Published
SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-69083 · GHSA-fph3-ghq9-vw66
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6371Published
Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore
osv · CVE-2026-73293 · GHSA-cxvf-gvfq-36w2
Go: github.com/semaphoreui/semaphore
GO-2026-6360Published
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) in github.com/openchoreo/openchoreo
osv · CVE-2026-73840 · GHSA-c5f6-2rm9-2w8g
Go: github.com/openchoreo/openchoreo
GO-2026-6412Published
SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-72799 · GHSA-5w7r-f4cg-rqq7
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6382Published
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode) in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-68584 · GHSA-7j72-f6wg-cxw6
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6357Published
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods in github.com/openchoreo/openchoreo
osv · CVE-2026-73667 · GHSA-2mw5-23gm-pccq
Go: github.com/openchoreo/openchoreo
GO-2026-6369Published
ffuf denial of service (OOM) via HTTP response decompression bomb in github.com/ffuf/ffuf
osv · CVE-2026-73232 · GHSA-jcvh-xf52-2cwm
Go: github.com/ffuf/ffuf · Go: github.com/ffuf/ffuf/v2
GO-2026-6358Published
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints in github.com/openchoreo/openchoreo
osv · CVE-2026-73841 · GHSA-52gf-6rpq-fgmx
Go: github.com/openchoreo/openchoreo
GO-2026-6373Published
SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-69086 · GHSA-7hm9-v7vf-7g4w
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6384Published
SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-68585 · GHSA-pm3w-vxp9-ccwc
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6368Published
OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList
osv · CVE-2026-75602 · GHSA-h6cj-26g5-67fv
Go: github.com/OpenListTeam/OpenList · Go: github.com/OpenListTeam/OpenList/v3 · Go: github.com/OpenListTeam/OpenList/v4
GO-2026-6386Published
SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-72809 · GHSA-3mp7-4rh5-jrv9
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6345Published
Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea
osv · CVE-2026-27779 · GHSA-v8f2-2ghq-9whv
Go: code.gitea.io/gitea
GO-2026-6344Published
Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea
osv · CVE-2026-26292 · GHSA-rc56-rj3f-xggf
Go: code.gitea.io/gitea
GO-2026-6359Published
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling in github.com/axllent/mailpit
osv · CVE-2026-67446 · GHSA-75mr-qw9x-3r39
Go: github.com/axllent/mailpit
GO-2026-6362Published
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs in github.com/openchoreo/openchoreo
osv · CVE-2026-73843 · GHSA-qh9r-j7rp-4x2m
Go: github.com/openchoreo/openchoreo
GO-2026-6381Published
SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-68587 · GHSA-69mh-gvh4-8gp7
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6347Published
Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea
osv · CVE-2026-27660 · GHSA-x92v-f5gc-r34v
Go: code.gitea.io/gitea
GO-2026-6353Published
SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-59834 · GHSA-h89q-4j2h-7h88
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6370Published
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation in github.com/semaphoreui/semaphore
osv · CVE-2026-73292 · GHSA-8cj9-r88m-8945
Go: github.com/semaphoreui/semaphore
GO-2026-6343Published
Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea
osv · CVE-2026-25782 · GHSA-qm72-8prh-g92x
Go: code.gitea.io/gitea
GO-2026-6346Published
Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea
osv · CVE-2026-27780 · GHSA-vhq7-fwwh-7hjf
Go: code.gitea.io/gitea
GHSA-x7m8-jrm8-hpvxPublished
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
osv ·
npm: @eigenpal/docx-editor-core · npm: @eigenpal/docx-editor-react
GHSA-hw8v-xxg5-vvvxPublished
n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
osv · CVE-2026-86076
npm: n8n · npm: n8n · npm: n8n
GHSA-hh89-3r9w-qj3jPublished
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
osv · CVE-2026-86075
npm: n8n · npm: n8n
CVE-2026-28599Published
In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interac…
cve-program ·
Vendor product: Android
CVE-2026-88282Published
GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection
cve-program ·
Vendor product: GV-LPCLPC2011/2211
CVE-2026-88283Published
GV-LPC2011/LPC2211 - ONVIF CreateUsers Repeated-Element Stack-Frame Overflow Denial of Service
cve-program ·
Vendor product: GV-LPC2011/LPC2211
CVE-2026-88004Published
Traefik entrypoint header-name sanitization bypassed via request trailers
cve-program ·
Vendor product: traefik
CVE-2026-28593Published
In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …
cve-program ·
Vendor product: Android
CVE-2026-81805Published
WordPress SiteSkite plugin <= 2.1.5 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: siteskite
CVE-2026-85581Published
SiYuan before v3.8.2 Denial of Service via unauthenticated UI-process registration
cve-program ·
Vendor product: siyuan
CVE-2026-85586Published
phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter
cve-program ·
Vendor product: phpMyFAQ
CVE-2026-85591Published
phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
cve-program ·
Vendor product: phpMyFAQ
CVE-2026-28607Published
In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i…
cve-program ·
Vendor product: Android
CVE-2026-85601Published
Grav Admin before 2.0.20 Cross-Site Scripting via marked.js
cve-program ·
Vendor product: grav
CVE-2026-74237Published
GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client
cve-program ·
Vendor product: GFI Exinda AI · Vendor product: GFI ClearView
CVE-2026-88284Published
GV-LPC2011/LPC2211 - ONVIF SetUser Repeated-Element Stack-Frame Overflow Denial of Service
cve-program ·
Vendor product: GV-LPC2011/LPC2211 -
CVE-2026-81791Published
WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: eventon-lite
CVE-2026-85618Published
ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives
cve-program ·
Vendor product: ConvertX
CVE-2026-85623Published
goose 1.37.0 Arbitrary Command Execution via Recipe Extensions
cve-program ·
Vendor product: goose
CVE-2026-85651Published
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
cve-program ·
Vendor product: trigger.dev
CVE-2026-81785Published
WordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: buddyforms
CVE-2026-85664Published
Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion
cve-program ·
Vendor product: chroma
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.