GHSA-pm4m-ph32-ghv5Published
js-yaml: Exponential parsing time in flow collections leads to denial of service
osv · CVE-2026-73643
npm: js-yaml
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700901 source statements · aliases may refer to the same vulnerabilityGHSA-j5qp-p44g-2m49Published
@asymmetric-effort/specifyjs: No redirect target validation in secureFetch
osv ·
npm: @asymmetric-effort/specifyjs
GHSA-p63j-vcc4-9vmvPublished
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate
osv · CVE-2026-73653
npm: @vitest/browser · npm: @vitest/browser · npm: @vitest/browser
GHSA-p9j2-gv94-2wf4Published
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
osv · CVE-2026-64645
npm: next · npm: next
GHSA-hrxh-6v49-42gfPublished
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
osv · GO-2026-6061
Go: google.golang.org/grpc
GHSA-cr32-g25g-vxjjPublished
showdown metadata title handling allows cross-site scripting
osv · CVE-2026-59711
npm: showdown
GHSA-cqjc-rmpq-xprqPublished
Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records
osv · CVE-2026-73489
crates.io: russh
GHSA-c5r6-m4mr-8q5jPublished
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
osv · CVE-2026-49856
npm: @jshookmcp/jshook
GHSA-chx6-hx7r-mcp5Published
React Router: Unauthenticated Denial of Service via Inefficient Route Matching
osv · CVE-2026-55685
npm: react-router
GHSA-9vcr-p3rj-q5q6Published
sigstore-go has a multi-log threshold bypass via single compromised log
osv · CVE-2026-49834 · GO-2026-5952
Go: github.com/sigstore/sigstore-go
GHSA-8q5v-6pqq-x66hPublished
Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability
osv · BIT-dotnet-2026-50525 · BIT-dotnet-sdk-2026-50525 · CVE-2026-50525
NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml
GHSA-93q6-wwjh-jc6hPublished
@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString
osv · CVE-2026-50290
npm: @asymmetric-effort/specifyjs
GHSA-8x88-c5mf-7j5wPublished
node-tar: Negative tar entry size causes infinite loop in archive replace
osv · CVE-2026-59874
npm: tar
GHSA-955p-x3mx-jcvpPublished
Next.js: Unauthenticated disclosure of internal Server Function endpoints
osv · CVE-2026-64643
npm: next · npm: next
GHSA-8xwf-rjm4-xvhvPublished
oras-go has file store write outside workingDir via symlink traversal
osv · CVE-2026-50162 · GO-2026-5879
Go: oras.land/oras-go/v2
GHSA-8r6m-32jq-jx6qPublished
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
osv · CVE-2026-73569
npm: fast-xml-parser
GHSA-7gcf-g7xr-8hxjPublished
serde_with: KeyValueMap serialization panics on empty sequence or map entries
osv ·
crates.io: serde_with
GHSA-7q8q-rj6j-mhjqPublished
Axios: Nested axios option objects can consume polluted prototype values
osv · CVE-2026-67319
npm: axios · npm: axios
GHSA-74j5-xf3v-crq8Published
dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS
osv · CVE-2026-50274 · GO-2026-6000
Go: github.com/DataDog/dd-trace-go · Go: github.com/DataDog/dd-trace-go/v2
GHSA-6r28-9ppf-4hj5Published
GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)
osv · CVE-2026-54345 · GO-2026-6121
Go: github.com/gopacket/gopacket
GHSA-6vch-q96h-7gc3Published
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
osv · BIT-etcd-2026-73500 · CVE-2026-73500 · GO-2026-6107
Go: go.etcd.io/etcd/v3 · Go: go.etcd.io/etcd/v3 · Go: go.etcd.io/etcd/v3
GHSA-6gr2-qh89-hxwmPublished
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
osv · CVE-2026-50143
npm: @apify/actors-mcp-server
GHSA-6g55-p6wh-862qPublished
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
osv · CVE-2026-45623
npm: postcss
GHSA-6gpp-xcg3-4w24Published
Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
osv · CVE-2026-64642
npm: next
GHSA-68g3-v927-f742Published
Next.js: Cache confusion of response bodies for requests with bodies
osv · CVE-2026-64648
npm: next · npm: next
GHSA-5xvq-cp9x-6p6rPublished
Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)
osv · CVE-2026-73430
crates.io: russh
GHSA-5xpp-75jx-m839Published
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
osv · CVE-2026-50289
npm: systeminformation
GHSA-5c7w-4wm3-85vwPublished
@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection
osv ·
npm: @asymmetric-effort/specifyjs
GHSA-4vj7-5mj6-jm8mPublished
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user
osv · CVE-2026-5078
npm: morgan
GHSA-q742-qvgc-gc2fPublished
TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
osv · CVE-2026-47759
npm: tinymce · npm: tinymce · npm: tinymce
GHSA-4j6x-2764-m8ghPublished
Rancher has over-inclusive team membership expansion in GitHub App authentication provider
osv · CVE-2026-41053 · GO-2026-5869
Go: github.com/rancher/rancher · Go: github.com/rancher/rancher · Go: github.com/rancher/rancher
GHSA-4w2j-m93h-cj5jPublished
Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
osv · CVE-2026-25800 · RUSTSEC-2026-0185
crates.io: quinn-proto
GHSA-525m-7f82-2mf7Published
@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields
osv · CVE-2026-49250
npm: @conform-to/dom
GHSA-23rf-6693-g89pPublished
Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability
osv · BIT-dotnet-2026-50648 · BIT-dotnet-sdk-2026-50648 · CVE-2026-50648
NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml
GHSA-3rjw-m598-pq24Published
Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
osv · CVE-2026-50185
crates.io: cmov
GHSA-42h9-826w-cgv3Published
Axios: Excessive recursion in formDataToJSON can cause denial of service
osv · CVE-2026-67313
npm: axios · npm: axios
GHSA-3jxr-9vmj-r5cpPublished
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
osv · CVE-2026-13149
npm: brace-expansion · npm: brace-expansion · npm: brace-expansion
GHSA-395f-4hp3-45gvPublished
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)
osv · CVE-2026-13311
npm: shell-quote
GHSA-2p49-hgcm-8545Published
SVGO removeScripts plugin leaves some executable scripts intact
osv · CVE-2026-73650
npm: svgo · npm: svgo · npm: svgo
GHSA-2rp8-mm9q-fp49Published
TypeORM: migration:generate template-literal code injection
osv · CVE-2026-73651
npm: typeorm · npm: typeorm
GHSA-22g5-r2x5-97cxPublished
showdown allows stored cross-site scripting through table header ID injection
osv · CVE-2026-59710
npm: showdown
GHSA-xhf5-7wjv-pqxpPublished
containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
osv · CVE-2026-53488 · GO-2026-5758
Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd/v2
GHSA-23hp-3jrh-7fpwPublished
node-tar: Decompression/parse DoS via unlimited input
osv · CVE-2026-59873
npm: tar
GHSA-xhgw-qwwf-pg32Published
ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader
osv · CVE-2026-10722 · GO-2026-6238
Go: github.com/cilium/ebpf
GHSA-xjvp-4fhw-gc47Published
runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations
osv · CVE-2026-41579 · GO-2026-5761
Go: github.com/opencontainers/runc · Go: github.com/opencontainers/runc · Go: github.com/opencontainers/runc
GHSA-xqjm-27pc-rvwmPublished
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
osv · CVE-2026-50179
npm: @actual-app/web
GHSA-xrhx-7g5j-rcj5Published
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
osv · CVE-2026-47674
npm: hono
GHSA-wcpc-wj8m-hjx6Published
protobufjs: Denial of service through unbounded Any expansion during JSON conversion
osv · CVE-2026-48712
npm: protobufjs · npm: protobufjs
GHSA-vmh5-mc38-953gPublished
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
osv · CVE-2026-9697
npm: undici · npm: undici
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.