GHSA-r47g-fvhr-h676Published
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
osv · CVE-2026-49459
npm: dompurify
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700901 source statements · aliases may refer to the same vulnerabilityGHSA-mh5m-5hw4-5c69Published
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
osv · CVE-2026-47760
npm: tinymce · NuGet: TinyMCE · Packagist: tinymce/tinymce
GHSA-pr7r-676h-xcf6Published
undici vulnerable to cross-user information disclosure via shared cache whitespace bypass
osv · CVE-2026-9678
npm: undici · npm: undici
GHSA-p6gq-j5cr-w38fPublished
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
osv · CVE-2026-82659
npm: nodemailer
GHSA-p88m-4jfj-68fvPublished
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding
osv · CVE-2026-9679
npm: undici · npm: undici · npm: undici
GHSA-p92q-9vqr-4j8vPublished
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
osv · CVE-2026-44487
npm: axios · npm: axios
GHSA-p3vc-36g9-x9grPublished
@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)
osv · CVE-2026-50171
npm: @angular/common · npm: @angular/common · npm: @angular/common
GHSA-mx8g-39q3-5c79Published
webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies
osv · CVE-2026-9595
npm: webpack-dev-server
GHSA-m973-pr9r-hp2wPublished
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat
osv · CVE-2026-46580
npm: @theia/ai-chat-ui · npm: @theia/ai-chat · npm: @theia/ai-claude-code
GHSA-85jm-cwp2-mvpvPublished
CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder
osv · CVE-2026-48796
NuGet: CefSharp.Common
GHSA-m2w9-h2mm-79qrPublished
Mattermost doesn't require system-level permission when patching protected default system roles
osv · CVE-2026-6739 · GO-2026-6285
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server
GHSA-g9jw-92q7-g7fjPublished
[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions
osv · CVE-2026-44691
npm: @theia/debug · npm: @theia/task · npm: @theia/workspace
GHSA-jfc7-64v2-mr8cPublished
@sigstore/core has DSSE payloadType type-binding failure
osv · CVE-2026-48758
npm: @sigstore/core
GHSA-jpvj-wpmj-h7rvPublished
Supply chain compromise via malicious @cap-js/openapi
osv ·
npm: @cap-js/openapi
GHSA-gxx4-3xcv-f8qxPublished
@angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSR
osv · CVE-2026-50556
npm: @angular/platform-server · npm: @angular/platform-server · npm: @angular/platform-server
GHSA-jmr9-qjv8-65gvPublished
extract-zip unvalidated symlink path traversal
osv · CVE-2026-56876
npm: extract-zip
GHSA-cxh2-4639-vmc5Published
OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
osv · CVE-2026-47701 · GO-2026-5339
Go: github.com/open-telemetry/opentelemetry-operator
GHSA-g8m3-5g58-fq7mPublished
undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching
osv · CVE-2026-11525
npm: undici · npm: undici · npm: undici
GHSA-gfj5-979r-92pwPublished
@acastellon/auth: Authentication bypass via spoofable headers in validateToken()
osv · CVE-2026-58399
npm: @acastellon/auth
GHSA-cv96-5348-p5p8Published
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
osv · CVE-2026-48148
npm: @budibase/server
GHSA-cmwh-pvxp-8882Published
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
osv · CVE-2026-65898
npm: dompurify
GHSA-cj8g-prcm-mfg5Published
@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
osv · CVE-2026-48037
npm: @hulumi/baseline
GHSA-cf98-j28v-49v6Published
OpenFGA Improper Policy Enforcement
osv · CVE-2026-55170 · GO-2026-5322
Go: github.com/openfga/openfga
GHSA-cq9c-6w48-qmfgPublished
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens
osv · CVE-2026-49229
npm: @actual-app/sync-server
GHSA-chgr-c6px-7xppPublished
PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures
osv · RUSTSEC-2026-0177
crates.io: pyo3
GHSA-5r4x-w6p5-222qPublished
ImageMagick: Use-After-Free in MSL decoder.
osv · CVE-2026-46523
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-4vgm-c2wm-63mwPublished
.NET Denial of Service Vulnerability
osv · BIT-aspnet-core-2026-26130 · CVE-2026-26130
NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm · NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm · NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm
GHSA-c27g-q93r-2cwfPublished
launch-editor vulnerable to command injection via the crafted request on Windows
osv · CVE-2024-52011
npm: launch-editor · npm: vite
GHSA-8396-jffm-qx4wPublished
OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning
osv · CVE-2026-48096 · GO-2026-5239
Go: github.com/openfga/openfga
GHSA-84g9-w2xq-vcv6Published
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
osv · CVE-2026-53663
npm: react-router · npm: @remix-run/server-runtime
GHSA-6v5v-wf23-fmfqPublished
markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations
osv · CVE-2026-48988
npm: markdown-it
GHSA-6vhh-4xw6-h2h2Published
Element Call reports full URLs of visited pages to analytics server
osv · CVE-2026-48007
npm: @element-hq/element-call-embedded
GHSA-5vwr-qchf-q4pfPublished
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths
osv ·
npm: @cyclonedx/cdxgen
GHSA-58w9-8g37-x9v5Published
@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)
osv · CVE-2026-54265
npm: @angular/compiler · npm: @angular/compiler · npm: @angular/compiler
GHSA-47q9-m4ww-924mPublished
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
osv · CVE-2026-48702 · GO-2026-5778
Go: github.com/sigstore/rekor
GHSA-5g86-85rp-f9hxPublished
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
osv · CVE-2026-48051
npm: @papra/webhooks
GHSA-45gg-vh54-h5m9Published
golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions
osv · CVE-2026-39828 · GO-2026-5014
Go: golang.org/x/crypto
GHSA-35p6-xmwp-9g52Published
undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse
osv · CVE-2026-6733
npm: undici · npm: undici · npm: undici
GHSA-36hh-v3qg-5jq4Published
PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
osv · RUSTSEC-2026-0176
crates.io: pyo3
GHSA-33vj-92qq-66hcPublished
containerd CRI checkpoint restore CDI annotation smuggling
osv · CVE-2026-53492 · GO-2026-5064
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd/v2
GHSA-2gcr-mfcq-wcc3Published
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
osv · CVE-2026-47676
npm: hono
GHSA-2r75-cxrj-cmphPublished
wasmtime-wasi: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
osv · CVE-2026-47261 · RUSTSEC-2026-0149
crates.io: wasmtime-wasi · crates.io: wasmtime-wasi · crates.io: wasmtime-wasi
GHSA-32g3-35g9-wc9gPublished
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
osv · CVE-2026-48036
npm: @hulumi/drift
GHSA-2mxr-p26x-mj73Published
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
osv · CVE-2026-48035
npm: @hulumi/baseline
GHSA-2h32-95rg-cpppPublished
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script
osv · CVE-2026-47428
npm: @vitest/browser · npm: @vitest/browser
GHSA-xx6v-rp6x-q39cPublished
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
osv · CVE-2026-42042
npm: axios · npm: axios
GHSA-268h-hp4c-crq3Published
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
osv · CVE-2026-82661
npm: nodemailer
GHSA-xx64-wwv2-hcqqPublished
astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks
osv · RUSTSEC-2026-0113
crates.io: astral-tokio-tar
GHSA-22p9-wv53-3rq4Published
LinkifyIt#match scan loop has quadratic algorithmic complexity
osv · CVE-2026-48801
npm: linkify-it
GHSA-xcj9-5m2h-648rPublished
Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection
osv · CVE-2026-41148
npm: mermaid · npm: mermaid
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.