GHSA-gxcp-jjxh-rwp4Published
Grafana: SQL Expressions Read File From Disk
osv · BIT-grafana-2026-33380 · CVE-2026-33380 · GO-2026-5409
Go: github.com/grafana/grafana
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700901 source statements · aliases may refer to the same vulnerabilityGHSA-fr8x-3vfx-f45hPublished
gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository
osv · CVE-2026-82251
crates.io: gitoxide · crates.io: gix
GHSA-gcmj-c9gg-9vh6Published
@joplin/onenote-converter: Path traversal in OneNote importer allows overwriting arbitrary files
osv · CVE-2026-22810
npm: @joplin/onenote-converter
GHSA-ghcm-xqfw-q4vrPublished
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
osv · CVE-2026-41149
npm: mermaid · npm: mermaid
GHSA-gf2q-c269-pqgcPublished
LiquidJS is Vulnerable to Remote Code Execution
osv · CVE-2026-45618
npm: liquidjs
GHSA-gfp8-mp24-5vxgPublished
@hulumi/baseline: CloudTrail selector tampering events were not fully detected
osv · CVE-2026-82863
npm: @hulumi/baseline
GHSA-g7cv-rxg3-hmpxPublished
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
osv · CVE-2026-45321
npm: @tanstack/arktype-adapter · npm: @tanstack/eslint-plugin-router · npm: @tanstack/eslint-plugin-start
GHSA-g9f8-wqj9-fjw5Published
Russh: Unchecked CryptoVec allocation and growth handling is reachable
osv · CVE-2026-46673 · RUSTSEC-2026-0153 · RUSTSEC-2026-0154
crates.io: russh-cryptovec · crates.io: russh
GHSA-fw8g-cg8f-9j28Published
Prometheus vulnerable to stored XSS via crafted histogram bucket label values in the old web UI heatmap display
osv · BIT-prometheus-2026-44903 · CVE-2026-44903 · GO-2026-5381
Go: github.com/prometheus/prometheus
GHSA-fv7c-fp4j-7gwpPublished
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input
osv · CVE-2026-44728
npm: @babel/plugin-transform-modules-systemjs · npm: @babel/plugin-transform-modules-systemjs
GHSA-g8f2-4f4f-5jqwPublished
SandboxJS has a sandbox escape via Function.caller leakage of internal call op
osv · CVE-2026-43898
npm: @nyariv/sandboxjs
GHSA-fqw6-gf59-qr4wPublished
containerd user ID handling bypass allows runAsNonRoot evasion
osv · CVE-2026-46680 · GO-2026-5378
Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd/v2
GHSA-f396-4rp4-7v2jPublished
Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host
osv · CVE-2026-46703 · GO-2026-5344 · PYSEC-2026-298 · RUSTSEC-2026-0148
PyPI: boxlite · crates.io: boxlite-cli · crates.io: boxlite
GHSA-ffhc-5mcf-pf4qPublished
Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
osv · CVE-2026-44581
npm: next · npm: next
GHSA-c73c-x77g-854rPublished
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
osv · CVE-2026-42073
npm: @gitlawb/openclaude
GHSA-f26g-jm89-4g65Published
gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules
osv · CVE-2026-40034
crates.io: gix
GHSA-9r33-xhw8-4qqpPublished
HAX CMS: Denial of Service using Malicious Import Request
osv · CVE-2026-46357
npm: @haxtheweb/haxcms-nodejs
GHSA-9ccr-r5hg-74gfPublished
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
osv · CVE-2026-45033
npm: @github/copilot
GHSA-8jr5-6gvj-rfpfPublished
@yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools
osv · CVE-2026-44895
npm: @yoda.digital/gitlab-mcp-server
GHSA-8jr4-6r33-phwmPublished
Summarize contains a path traversal vulnerability
osv · CVE-2026-45242
npm: @steipete/summarize
GHSA-8m7c-8m39-rv4xPublished
awslabs/tough Delegated Roles have a Signature Threshold Bypass
osv · CVE-2026-6966
crates.io: tough · crates.io: tuftool
GHSA-8h8q-6873-q5fjPublished
Next.js Vulnerable to Denial of Service with Server Components
osv ·
npm: next · npm: next
GHSA-86m8-88fq-xfxpPublished
Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes
osv · CVE-2026-45741 · GO-2026-5244
Go: github.com/gotenberg/gotenberg/v8
GHSA-87f9-hvmw-gh4pPublished
Mermaid: Improper sanitization of configuration leads to CSS injection
osv · CVE-2026-41159
npm: mermaid · npm: mermaid
GHSA-5v3h-x4wf-5c35Published
Rancher Extensions have arbitrary file access via path traversal
osv · CVE-2026-25705 · GO-2026-5154
Go: github.com/rancher/rancher · Go: github.com/rancher/rancher · Go: github.com/rancher/rancher
GHSA-898c-q2cr-xwhgPublished
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
osv · CVE-2026-44490
npm: axios · npm: axios
GHSA-6chq-wfr3-2hj9Published
Axios: Header Injection via Prototype Pollution
osv · CVE-2026-42035
npm: axios · npm: axios
GHSA-89vp-x53w-74fxPublished
rmcp Streamable HTTP server transport has a DNS rebinding vulnerability
osv · CVE-2026-42559 · GHSA-fvh2-gm75-j4j7 · RUSTSEC-2026-0140 · RUSTSEC-2026-0189
crates.io: rmcp
GHSA-5wrp-cwcj-q835Published
opentelemetry-go's baggage parsing no longer caps raw header length
osv · CVE-2026-41178 · GO-2026-5158
Go: go.opentelemetry.io/otel/baggage · Go: go.opentelemetry.io/otel/propagation · Go: go.opentelemetry.io/otel/baggage
GHSA-5c46-x3qw-q7j7Published
WebdriverIO BrowserStack Service has a Command Injection issue
osv · CVE-2026-25244
npm: @wdio/browserstack-service
GHSA-5wm8-gmm8-39j9Published
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes
osv · CVE-2026-44665
npm: fast-xml-builder
GHSA-4v58-8p28-2rq3Published
awslabs/tough is Missing Delegated Metadata Validation
osv · CVE-2026-6967
crates.io: tough · crates.io: tuftool
GHSA-5624-2pmv-jx46Published
Summarize contains a missing authorization vulnerability
osv · CVE-2026-45243
npm: @steipete/summarize
GHSA-492v-c6pp-mqqvPublished
Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
osv · CVE-2026-44574
npm: next · npm: next
GHSA-45c6-75p6-83ccPublished
fast-xml-builder Comment Value regex can be bypassed
osv · CVE-2026-44664
npm: fast-xml-builder
GHSA-59f3-7227-wmh4Published
@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
osv · CVE-2026-82855
npm: @hulumi/policies
GHSA-44m2-crh7-f4q2Published
Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL
osv · CVE-2026-45717
npm: @budibase/server
GHSA-47p6-69vm-vw6vPublished
@koa/router has an Access Control Bypass
osv · CVE-2026-9495
npm: @koa/router
GHSA-3qcw-2rhx-2726Published
Turbo: Unexpected local code execution during Yarn Berry detection
osv · CVE-2026-45772
npm: turbo · npm: @turbo/codemod · npm: @turbo/workspaces
GHSA-3g43-6gmg-66jwPublished
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
osv · CVE-2026-44495
npm: axios · npm: axios
GHSA-3g8h-86w9-wvmqPublished
Next.js's Middleware / Proxy redirects can be cache-poisoned
osv · CVE-2026-44572
npm: next · npm: next
GHSA-3644-q5cj-c5c7Published
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
osv · CVE-2026-45134 · PYSEC-2026-2555 · PYSEC-2026-2560 · PYSEC-2026-2582
PyPI: langsmith · npm: langsmith · PyPI: langchain-classic
GHSA-389r-gv7p-r3rpPublished
go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git
osv · CVE-2026-45022 · GO-2026-5074
Go: github.com/go-git/go-git/v6 · Go: github.com/go-git/go-git/v5
GHSA-363w-hvwh-w7m6Published
Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API
osv · CVE-2026-45719
npm: @budibase/server
GHSA-mw3m-pqr2-qv7cPublished
ImageMagick has an Out-of-Bounds write of a zero byte in its X11 display interaction
osv · CVE-2026-33535
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-36hh-x5p5-jgc8Published
@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters
osv · CVE-2026-44974
npm: @hapi/content
GHSA-36qx-fr4f-26g5Published
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
osv · CVE-2026-44573
npm: next · npm: next
GHSA-35jp-ww65-95whPublished
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
osv · CVE-2026-44494
npm: axios
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.