GHSA-2m6p-hm3w-6jm3Published
HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft
osv · CVE-2026-46496
npm: @haxtheweb/haxcms-nodejs · npm: @haxtheweb/video-player
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700901 source statements · aliases may refer to the same vulnerabilityGHSA-2pr8-phx7-x9h3Published
protobuf.js: Denial of service from crafted field names in generated code
osv · CVE-2026-44294
npm: protobufjs · npm: protobufjs
GHSA-2v5f-5r6w-p67rPublished
MCP Registry: OCI validator skips ownership check on upstream rate limits
osv · CVE-2026-45781 · GO-2026-5008
Go: github.com/modelcontextprotocol/registry
GHSA-32mq-hpph-xfvrPublished
@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes
osv · CVE-2026-45783
npm: @libp2p/kad-dht
GHSA-2r69-qgv3-hr65Published
Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links
osv · CVE-2026-45245
npm: @steipete/summarize
GHSA-2p6r-x3vv-xqm2Published
rpassword affected by partial password reveal when input is interrupted
osv ·
crates.io: rpassword
GHSA-2pmr-289p-44r3Published
Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes
osv · CVE-2026-42592 · GO-2026-4990
Go: github.com/gotenberg/gotenberg/v8
GHSA-xx5w-cvp6-jv83Published
Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access
osv · CVE-2026-34987 · RUSTSEC-2026-0095
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-x92x-px7w-4gx4Published
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field
osv · CVE-2026-41328 · GO-2026-5749
Go: github.com/dgraph-io/dgraph/v25 · Go: github.com/dgraph-io/dgraph/v24 · Go: github.com/dgraph-io/dgraph
GHSA-22w3-693w-x895Published
webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed
osv ·
crates.io: webauthn-rs-core · crates.io: webauthn-authenticator-rs · crates.io: webauthn-rs-core
GHSA-xhj4-vrgc-hr34Published
actix-http has HTTP/1.1 CL.TE Request Smuggling
osv · CVE-2026-73051
crates.io: actix-http
GHSA-267c-6grr-h53fPublished
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
osv · CVE-2026-44575
npm: next · npm: next
GHSA-x4mj-7f9g-29h4Published
Contour has Lua code injection via Cookie Path Rewrite Policy
osv · BIT-contour-2026-41246 · CVE-2026-41246 · GO-2026-5738
Go: github.com/projectcontour/contour · Go: github.com/projectcontour/contour · Go: github.com/projectcontour/contour
GHSA-xf4j-xp2r-rqqxPublished
Hono: Path traversal in toSSG() allows writing files outside the output directory
osv · CVE-2026-39408
npm: hono
GHSA-w3x6-4m5h-cxqfPublished
Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability
osv · BIT-dotnet-2026-26171 · BIT-dotnet-sdk-2026-26171 · BIT-powershell-2026-26171 · CVE-2026-26171
NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml
GHSA-wf45-q9ch-q8ghPublished
Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability
osv · BIT-thrift-2026-41602 · CVE-2026-41602
Go: github.com/apache/thrift
GHSA-x2wv-9p67-mh9wPublished
uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails
osv · CVE-2026-35350
crates.io: coreutils
GHSA-wjxp-xrpv-xpffPublished
Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
osv · CVE-2026-40161 · GO-2026-5711
Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline
GHSA-wh4c-j3r5-mjhpPublished
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
osv · CVE-2026-34601
npm: xmldom · npm: @xmldom/xmldom · npm: @xmldom/xmldom
GHSA-w24r-5266-9c3cPublished
Clerk has an authorization bypass when combining organization, billing, or reverification checks
osv · CVE-2026-42349
npm: @clerk/shared · npm: @clerk/shared · npm: @clerk/backend
GHSA-w5hq-g745-h8pqPublished
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided
osv · CVE-2026-41907 · CVE-2026-41988
npm: uuid · npm: uuid · npm: uuid
GHSA-w8m4-4v35-v6x3Withdrawn
Duplicate Advisory: uutils coreutils allows unauthorized modification of permissions on existing files
osv ·
crates.io: coreutils
GHSA-w8rr-5gcm-pp58Published
opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies
osv · CVE-2026-39882 · GO-2026-4985
Go: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp · Go: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp · Go: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
GHSA-8793-7xv6-82cfPublished
ImageMagick has an Out-of-bounds Write via InterpretImageFilename
osv · CVE-2026-33536
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-vvjj-xcjg-gr5gPublished
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
osv · CVE-2026-82853
npm: nodemailer
GHSA-vw86-c94w-v3x4Published
SiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`
osv · CVE-2026-40318 · GO-2026-5679
Go: github.com/siyuan-note/siyuan/kernel
GHSA-vmx8-mqv2-9gmgPublished
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
osv · BIT-helm-2026-35204 · CVE-2026-35204 · GO-2026-5666
Go: helm.sh/helm/v4
GHSA-vvf7-6rmr-m29qPublished
Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars
osv · CVE-2026-41492 · GO-2026-5675
Go: github.com/dgraph-io/dgraph/v25 · Go: github.com/dgraph-io/dgraph/v24 · Go: github.com/dgraph-io/dgraph
GHSA-v9jr-rg53-9pgpPublished
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
osv · CVE-2026-41238
npm: dompurify
GHSA-vp29-5652-4fw9Published
CoreDNS has TSIG authentication bypass on gRPC and QUIC transports
osv · CVE-2026-35579 · GO-2026-5667
Go: github.com/coredns/coredns
GHSA-vf87-345h-9qhxWithdrawn
Duplicate Advisory: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
osv ·
crates.io: coreutils
GHSA-vp6q-mv9j-j428Withdrawn
Duplicate Advisory: uutils coreutils incorrectly handles exit codes when processing multiple files
osv ·
crates.io: coreutils
GHSA-vchc-9ggh-3236Withdrawn
Duplicate Advisory: uutils coreutils has a Path Traversal issue
osv ·
crates.io: coreutils
GHSA-rv5g-f82m-qrvvPublished
LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel
osv · CVE-2026-39412
npm: liquidjs
GHSA-v762-x3cf-5mfgWithdrawn
Duplicate Advisory: uutils coreutils has a Link Following Issue Via rm Utility
osv ·
crates.io: coreutils
GHSA-rmx9-2pp3-xhcrPublished
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching
osv · CVE-2026-25542 · GO-2026-5630
Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline
GHSA-rp42-5vxx-qpwrPublished
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
osv · CVE-2026-41324
npm: basic-ftp
GHSA-rggm-jjmc-3394Published
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access
osv · BIT-kyverno-2026-4789 · CVE-2026-4789 · GO-2026-5621
Go: github.com/kyverno/kyverno
GHSA-rr7j-v2q5-chgvPublished
LangSmith SDK: Streaming token events bypass output redaction
osv · CVE-2026-41182 · PYSEC-2026-2583
npm: langsmith · PyPI: langsmith
GHSA-rch3-82jr-f9w9Published
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
osv · BIT-jupyter-base-notebook-2026-40171 · BIT-jupyter-notebook-2026-40171 · BIT-jupyterlab-2026-40171 · CVE-2026-40171
npm: @jupyter-notebook/help-extension · PyPI: notebook · PyPI: jupyterlab
GHSA-rx35-6rhx-7858Published
Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check
osv · CVE-2026-40923 · GO-2026-5643
Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline
GHSA-qqfj-4vcm-26hvPublished
Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64
osv · CVE-2026-34944 · RUSTSEC-2026-0087
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-qhmp-q7xh-99rhPublished
CoreDNS has TSIG authentication bypass on DoT, DoH, DoH3, DoQ, and gRPC
osv · CVE-2026-33190 · GO-2026-5583
Go: github.com/coredns/coredns
GHSA-r2pg-r6h7-crf3Published
External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine
osv · CVE-2026-34984 · GO-2026-5602
Go: github.com/external-secrets/external-secrets · Go: github.com/external-secrets/external-secrets
GHSA-qx2v-qp2m-jg93Published
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
osv · CVE-2026-41305
npm: postcss
GHSA-qqx8-2xmm-jrv8Published
ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
osv · CVE-2026-40611 · GO-2026-5593
Go: github.com/go-acme/lego/v4 · Go: github.com/go-acme/lego/v3 · Go: github.com/go-acme/lego
GHSA-r67j-r569-jrwpPublished
Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion
osv · BIT-thrift-2026-41636 · CVE-2026-41636
npm: thrift
GHSA-r65v-xgwc-g56jPublished
OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)
osv · BIT-openbao-2026-39396 · CVE-2026-39396 · GO-2026-5609
Go: github.com/openbao/openbao
GHSA-r5rp-j6wh-rvv4Published
Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()
osv · CVE-2026-39410
npm: hono
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.