GHSA-x8qc-fggm-mpqgPublished
Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader
osv · CVE-2026-7482 · GO-2026-5748
Go: github.com/ollama/ollama
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700901 source statements · aliases may refer to the same vulnerabilityGHSA-w5pp-99ch-qj29Published
go-git: Malformed Git object data may cause panics or resource exhaustion
osv · GO-2026-5693
Go: github.com/go-git/go-git/v5 · Go: github.com/go-git/go-git/v6
GHSA-x35m-3gp4-4fh5Published
etcd RBAC bypass allows unauthorized data access via PrevKv/lease attachment in nested transaction Put requests
osv · BIT-etcd-2026-44283 · CVE-2026-44283 · GO-2026-5736
Go: go.etcd.io/etcd/v3 · Go: go.etcd.io/etcd/v3 · Go: go.etcd.io/etcd
GHSA-x7q7-fchv-8h2jPublished
@ranfdev/deepobj has a Prototype Pollution vulnerability
osv · CVE-2026-46509
npm: @ranfdev/deepobj
GHSA-x7j8-49r8-mr43Published
@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty
osv · CVE-2026-46681
npm: @nevware21/ts-utils
GHSA-w4pp-8pjf-rmxwPublished
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
osv · CVE-2026-9496
npm: pacote
GHSA-w5p8-4jcx-2j6rPublished
imageproc: integer overflow in kernel size check leads to out-of-bounds read
osv · RUSTSEC-2026-0116
crates.io: imageproc · crates.io: imageproc · crates.io: imageproc
GHSA-w239-58x2-q8p5Published
go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth
osv · CVE-2026-42328 · GO-2026-5684
Go: github.com/ipld/go-ipld-prime
GHSA-vp62-88p7-qqf5Published
Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
osv · CVE-2026-41568 · GO-2026-5668
Go: github.com/docker/docker · Go: github.com/moby/moby/v2 · Go: github.com/moby/moby
GHSA-rpc6-9c4p-j5cgPublished
@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
osv · CVE-2026-8766
npm: @kilocode/cli
GHSA-rpj4-7x2v-wjrfPublished
Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation
osv · CVE-2026-45548
npm: @budibase/server
GHSA-rpmf-866q-6p89Published
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
osv · CVE-2026-44240
npm: basic-ftp
GHSA-qq3r-w4hj-gjp6Published
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
osv · CVE-2026-42574 · GO-2026-5589
Go: chainguard.dev/apko
GHSA-r48c-v28r-pf6vPublished
MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist
osv · CVE-2026-44430 · GO-2026-5607
Go: github.com/modelcontextprotocol/registry
GHSA-qg8r-f7x3-25f7Published
imageproc: Out-of-bounds read via NaN coordinates in bilinear/bicubic sampling
osv · RUSTSEC-2026-0117
crates.io: imageproc · crates.io: imageproc · crates.io: imageproc
GHSA-q3j6-qgpj-74h6Published
fast-uri vulnerable to path traversal via percent-encoded dot segments
osv · CVE-2026-6321
npm: fast-uri · npm: fast-uri
GHSA-pjv4-3c63-699fPublished
opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay
osv · CVE-2026-42602 · GO-2026-5544
Go: github.com/open-telemetry/opentelemetry-collector-contrib/extension/azureauthextension
GHSA-pvw4-cvr4-97p8Published
Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)
osv · CVE-2026-46421
npm: @cap-js/sqlite · npm: @cap-js/postgres · npm: @cap-js/db-service
GHSA-pjwm-pj3p-43mvPublished
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
osv · CVE-2026-44492
npm: axios · npm: axios
GHSA-q2f7-m237-v562Published
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators
osv · CVE-2026-82856
npm: @hulumi/policies
GHSA-pmwg-cvhr-8vh7Published
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
osv · CVE-2026-42043
npm: axios · npm: axios
GHSA-pf86-5x62-jrwfPublished
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
osv · CVE-2026-42033
npm: axios · npm: axios
GHSA-p77w-8qqv-26rmPublished
Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
osv · CVE-2026-44457
npm: hono
GHSA-p69w-mmfv-xrfjPublished
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
osv · CVE-2026-43945
npm: @frangoteam/fuxa
GHSA-ph9p-34f9-6g65Published
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape
osv · CVE-2026-44705
npm: tmp
GHSA-pmwq-pjrm-6p5rPublished
in-toto-golang and in-toto-python have inconsistent negation behavior
osv · GO-2026-5547
Go: github.com/in-toto/in-toto-golang
GHSA-p8xm-42r7-89xgPublished
wasmtime has a panic when allocating a table exceeding the size of the host's address space
osv · CVE-2026-44216 · RUSTSEC-2026-0114
crates.io: wasmtime · crates.io: wasmtime
GHSA-pgh9-mpwc-8jjfPublished
Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS
osv · CVE-2025-71261 · GO-2026-5538
Go: github.com/harvester/harvester
GHSA-pg4w-g64p-qwhjPublished
gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository
osv · CVE-2026-82252
crates.io: gitoxide · crates.io: gix
GHSA-mpmf-3w4r-qfpfPublished
KubeVirt has a Link Following issue
osv · CVE-2026-9804 · GO-2026-5883
Go: kubevirt.io/kubevirt
GHSA-mc57-h6j3-3hmvPublished
iskorotkov/avro: Integer Overflow in Decoder
osv · CVE-2026-46384 · GO-2026-5047
Go: github.com/iskorotkov/avro/v2
GHSA-mg66-mrh9-m8jxPublished
Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
osv · CVE-2026-44579
npm: next · npm: next
GHSA-m67g-87rx-v42cPublished
Calico Inserts Sensitive Information into Log File
osv · CVE-2026-41185 · GO-2026-5891
Go: github.com/projectcalico/calico · Go: github.com/projectcalico/calico
GHSA-jxxr-4gwj-5jf2Published
brace-expansion: Large numeric range defeats documented `max` DoS protection
osv · CVE-2026-45149
npm: brace-expansion
GHSA-m6xr-fvfg-5g64Published
Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal
osv · CVE-2026-46378 · GO-2026-5493
Go: github.com/tomwright/dasel/v3
GHSA-m7hm-vm4x-28jfPublished
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
osv · CVE-2026-42576 · GO-2026-5497
Go: chainguard.dev/apko
GHSA-m7cr-m3pv-hgrpPublished
go-git: Improper single-quote escaping in go-git SSH transport
osv · CVE-2026-45570 · GO-2026-5496
Go: github.com/go-git/go-git/v5 · Go: github.com/go-git/go-git/v6 · Go: github.com/go-git/go-git
GHSA-m5j3-4634-c2vqPublished
Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string
osv · CVE-2026-46377 · GO-2026-5491
Go: github.com/tomwright/dasel/v3
GHSA-jggg-4jg4-v7c6Published
protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion
osv · CVE-2026-45740
npm: protobufjs · npm: protobufjs
GHSA-m7pr-hjqh-92cmPublished
Axios: no_proxy bypass via IP alias allows SSRF
osv · CVE-2026-42038
npm: axios · npm: axios
GHSA-jvwf-75h9-cwggPublished
protobuf.js: Process-wide denial of service through unsafe option paths
osv · CVE-2026-44290
npm: protobufjs · npm: protobufjs
GHSA-jwp7-wg77-3w9vPublished
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
osv · CVE-2026-46341
npm: @apify/actors-mcp-server
GHSA-jh3h-rpxg-fr36Published
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover
osv · CVE-2026-46396
npm: @haxtheweb/haxcms-nodejs · npm: @haxtheweb/video-player · npm: @haxtheweb/iframe-loader
GHSA-j4fx-xxwh-2485Published
jsondiffpatch patch APIs are vulnerable to prototype pollution
osv · CVE-2026-8657
npm: jsondiffpatch
GHSA-hqmv-v56g-4m47Published
Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers
osv · CVE-2026-39964
npm: @typebot.io/js
GHSA-hvx9-hwr7-wjj9Published
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
osv · CVE-2026-44724
npm: systeminformation
GHSA-hpv4-5h6f-wqr3Published
russh server userauth state is not reset when authentication principal changes
osv · CVE-2026-46705
crates.io: russh
GHSA-h98r-wv3h-fr38Published
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
osv · BIT-argo-cd-2026-45738 · CVE-2026-45738 · GO-2026-5418
Go: github.com/argoproj/argo-cd/v3 · Go: github.com/argoproj/argo-cd/v3 · Go: github.com/argoproj/argo-cd/v3
GHSA-hm8q-7f3q-5f36Published
Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
osv · CVE-2026-44459
npm: hono
GHSA-gx5p-jg67-6x7hPublished
Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
osv · CVE-2026-44580
npm: next · npm: next
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.