GHSA-cf44-9pgv-m4xcPublished
rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote
osv · BIT-rclone-2026-54572 · CVE-2026-54572 · GO-2026-6191
Go: github.com/rclone/rclone
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700901 source statements · aliases may refer to the same vulnerabilityGHSA-8j4g-w8fx-2239Published
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
osv · CVE-2026-69207
npm: hono
GHSA-8xcm-r25x-g524Published
undici vulnerable to downstream response desynchronization via retry interceptor
osv · CVE-2026-16728
npm: undici · npm: undici · npm: undici
GHSA-8rc5-4fr6-64pwPublished
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write
osv · CVE-2026-63328 · GO-2026-6250
Go: github.com/aquasecurity/trivy
GHSA-8c48-q9wj-3w37Published
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines
osv · BIT-rclone-2026-71311 · CVE-2026-71311 · GO-2026-6187
Go: github.com/rclone/rclone
GHSA-79qm-7rj5-m7r9Published
Hono: Proxy Helper does not remove response headers listed in the `Connection` header
osv · CVE-2026-71849
npm: hono
GHSA-7236-3392-c5c6Published
BuildKit: Custom frontend could bypass Seccomp/AppArmor
osv · CVE-2026-61711 · GO-2026-6255
Go: github.com/moby/buildkit
GHSA-72x6-4j93-7w86Published
BuildKit has a possible runtime DoS via unbounded group parsing
osv · CVE-2026-61712 · GO-2026-6256
Go: github.com/moby/buildkit
GHSA-6hqm-hm2v-3p2pWithdrawn
Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
osv ·
npm: axios
GHSA-6x64-9x62-f2gxPublished
Mermaid allows CSS injection applying to sibling elements of the diagram
osv · CVE-2026-50159
npm: mermaid · npm: mermaid
GHSA-5x78-73v4-xg6wPublished
postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
osv · RUSTSEC-2026-0179
crates.io: postgres-protocol
GHSA-6f2p-296r-cc28Published
Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
osv · CVE-2026-54168 · GO-2026-6263
Go: github.com/openshift-pipelines/pipelines-as-code · Go: github.com/openshift-pipelines/pipelines-as-code · Go: github.com/openshift-pipelines/pipelines-as-code
GHSA-48p8-g2fx-3wwmPublished
Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)
osv · BIT-argo-workflows-2026-54526 · CVE-2026-54526 · GO-2026-6223
Go: github.com/argoproj/argo-workflows/v4 · Go: github.com/argoproj/argo-workflows/v3 · Go: github.com/argoproj/argo-workflows
GHSA-45pq-889g-fcghPublished
rclone: Incomplete path validation allows backend root escape in serve restic
osv · BIT-rclone-2026-71309 · CVE-2026-71309 · GO-2026-6184
Go: github.com/rclone/rclone
GHSA-55q2-fjhq-7xh7Published
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
osv · CVE-2026-75838
npm: dompurify
GHSA-4cwx-7wf7-3272Published
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
osv · CVE-2026-13697
npm: undici · npm: undici
GHSA-3rrr-jr9j-h3q3Published
Mermaid Architecture diagrams are vulnerable to prototype pollution
osv · CVE-2026-71437
npm: mermaid
GHSA-42cj-99w8-cp2pPublished
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
osv · CVE-2026-45404 · GO-2026-6258
Go: go.opentelemetry.io/otel/bridge/opentracing
GHSA-2v8p-3f2j-5mp7Published
Mermaid XY Charts are vulnerable to an infinite loop DoS
osv · CVE-2026-71436
npm: mermaid · npm: mermaid
GHSA-22jq-vg5j-6vggPublished
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
osv · CVE-2026-54272
npm: ip-address
GHSA-xw57-23p8-9wc5Published
@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
osv ·
npm: @asymmetric-effort/specifyjs
GHSA-2vh6-hw4j-32wwPublished
gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)
osv · CVE-2026-82250
crates.io: gix-packetline
GHSA-38gx-cfqf-f652Withdrawn
Duplicate Advisory: Axios: Prototype pollution auth subfields can inject Basic auth
osv ·
npm: axios
GHSA-22w5-2fxg-vrwxPublished
OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or compromised servers
osv · GO-2026-6262
Go: github.com/opentofu/opentofu · Go: github.com/opentofu/opentofu
GHSA-xvcm-6775-5m9rPublished
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set
osv · CVE-2026-59880
npm: immutable · npm: immutable · npm: immutable
GHSA-xv26-6w52-cph6Published
websocket-driver: Message corruption via abuse of protocol length headers
osv · CVE-2026-54466
npm: websocket-driver
GHSA-xgjw-pm74-86q4Published
sigstore-js has Insufficient Verification of Data Authenticity
osv · CVE-2026-48816
npm: @sigstore/verify
GHSA-xcpc-8h2w-3j85Published
adm-zip: Crafted ZIP file triggers 4GB memory allocation
osv · CVE-2026-39244
npm: adm-zip
GHSA-xj6q-8x83-jv6gPublished
Axios: Prototype pollution auth subfields can inject Basic auth
osv · CVE-2026-67314
npm: axios
GHSA-xmf8-cvqr-rfgjPublished
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
osv · CVE-2026-73418
npm: @auth/core · npm: next-auth · npm: next-auth
GHSA-wxqq-gcq8-c443Published
dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS
osv · CVE-2026-50272
npm: dd-trace
GHSA-wg4g-wm44-ch5jPublished
Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message
osv · CVE-2026-54908 · GO-2026-6165
Go: github.com/pion/dtls/v3
GHSA-wqqc-jjcq-vfxmPublished
sigstore-go fails to check signature timestamps against a signing key's validity period
osv · CVE-2026-54787 · GO-2026-6162
Go: github.com/sigstore/sigstore-go
GHSA-wrjc-x8rr-h8h6Published
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
osv · CVE-2026-53669
npm: react-router
GHSA-w62v-xxxg-mg59Published
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
osv · CVE-2026-59895
npm: hono
GHSA-w8wr-v893-vjvpPublished
node-tar: Process crash via PAX numeric path type confusion
osv · CVE-2026-59871
npm: tar
GHSA-vx8h-4prv-g744Published
Rancher has Privilege Escalation from Project Owner to Host
osv · CVE-2026-41052 · GO-2026-5876
Go: github.com/rancher/rancher · Go: github.com/rancher/rancher · Go: github.com/rancher/rancher
GHSA-vh4v-2xq2-g5cgPublished
ORAS Go forwards registry credentials across registry redirects
osv · GO-2026-5884
Go: oras.land/oras-go/v2
GHSA-vv65-f55v-xm6gPublished
Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)
osv ·
npm: @grackle-ai/runtime-sdk · npm: @grackle-ai/powerline
GHSA-v245-v573-v5vmPublished
linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
osv · CVE-2026-59887
npm: linkify-it
GHSA-v2hh-gcrm-f6hxPublished
fast-uri vulnerable to host confusion via literal backslash authority delimiter
osv · CVE-2026-16221
npm: fast-uri · npm: fast-uri · npm: fast-uri
GHSA-r635-g3xr-vw7xPublished
Socket.IO: Engine.IO Polling Transport Connection Exhaustion
osv · CVE-2026-59725
npm: engine.io
GHSA-q675-qj96-32m9Published
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
osv · CVE-2026-46599 · GO-2026-5032
Go: golang.org/x/image
GHSA-q6h5-q3q6-f87xPublished
CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation
osv · BIT-cilium-2026-53935 · BIT-cilium-operator-2026-53935 · BIT-hubble-relay-2026-53935 · CVE-2026-53935
Go: github.com/cilium/cilium · Go: github.com/cilium/cilium · Go: github.com/cilium/cilium
GHSA-qcr8-x557-7cp3Published
@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state
osv ·
npm: @asymmetric-effort/specifyjs
GHSA-pmv8-rq9r-6j72Published
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
osv · CVE-2026-67312
npm: axios · npm: axios
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.