GHSA-qj83-cq47-w5f8Published
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
osv · CVE-2026-39865
npm: axios
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700901 source statements · aliases may refer to the same vulnerabilityGHSA-q834-8qmm-v933Published
OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies
osv · CVE-2026-40182
NuGet: OpenTelemetry.Exporter.OpenTelemetryProtocol
GHSA-q98v-9f9w-f49qPublished
Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint
osv · CVE-2026-5724 · GO-2026-5578
Go: go.temporal.io/server · Go: go.temporal.io/server · Go: go.temporal.io/server
GHSA-q6m9-xj2w-xmrcPublished
uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
osv · CVE-2026-35360
crates.io: coreutils
GHSA-q93q-v844-jrqpPublished
kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
osv · BIT-kyverno-2026-40868 · CVE-2026-40868 · GO-2026-5575
Go: github.com/kyverno/kyverno
GHSA-q4gf-8mx6-v5v3Published
Next.js has a Denial of Service with Server Components
osv ·
npm: next · npm: next
GHSA-q49f-xg75-m9xwPublished
Wasmtime has host panic when Winch compiler executes `table.fill`
osv · CVE-2026-34946 · RUSTSEC-2026-0089
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-q5jf-9vfq-h4h7Published
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
osv · BIT-helm-2026-35205 · CVE-2026-35205 · GO-2026-5566
Go: helm.sh/helm/v4
GHSA-q94g-3gcf-66x7Withdrawn
Duplicate Advisory: uutils coreutils has an Incorrect Authorization issue
osv ·
crates.io: coreutils
GHSA-pc3f-x583-g7j2Published
SpdyStream: DOS on CRI
osv · CVE-2026-35469 · GO-2026-4958
Go: github.com/moby/spdystream
GHSA-p9ff-h696-f583Published
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket
osv · CVE-2026-39363
npm: vite · npm: vite · npm: vite
GHSA-p49j-v9wc-wg57Published
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
osv · BIT-openbao-2026-40264 · CVE-2026-40264 · GO-2026-5526
Go: github.com/openbao/openbao
GHSA-mh5c-xrmh-m794Published
uutils coreutils has an Untrusted Search Path
osv · CVE-2026-35368
crates.io: coreutils
GHSA-mmg9-6m6j-jqqxPublished
LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter
osv · CVE-2026-34166
npm: liquidjs
GHSA-pjcq-xvwq-hhpjPublished
go-ntlmssp NTLM challenges can panic on malformed payloads
osv · CVE-2026-32952 · GO-2026-5543
Go: github.com/Azure/go-ntlmssp
GHSA-m758-wjhj-p3jqPublished
Wasmtime has a possible panic when lifting `flags` component value
osv · CVE-2026-34943 · RUSTSEC-2026-0085
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-m9w2-8782-2946Published
Wasmtime has host data leakage with 64-bit tables and Winch
osv · CVE-2026-34945 · RUSTSEC-2026-0086
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-m9hq-h476-h2g8Published
Pyroscope Exposes Storage Secret
osv · BIT-grafana-pyroscope-2025-41118 · CVE-2025-41118 · GO-2026-5501
Go: github.com/grafana/pyroscope · Go: github.com/grafana/pyroscope
GHSA-mh2q-q3fh-2475Published
OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)
osv · CVE-2026-29181 · GO-2026-5506
Go: go.opentelemetry.io/otel
GHSA-m976-87wm-48fmPublished
uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
osv · CVE-2026-35364
crates.io: coreutils
GHSA-m2w4-8ggf-rj47Published
HashiCorp Vault has a KVv2 Metadata and Secret Deletion Policy Bypass that leads to Denial-of-Service
osv · BIT-vault-2026-3605 · CVE-2026-3605 · GO-2026-5487
Go: github.com/hashicorp/vault
GHSA-hx6p-xpx3-jvvvPublished
Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding
osv · CVE-2026-34941 · RUSTSEC-2026-0093
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-j759-j44w-7fr8Published
xmldom has XML node injection through unvalidated comment serialization
osv · CVE-2026-41672
npm: @xmldom/xmldom · npm: @xmldom/xmldom · npm: xmldom
GHSA-j88v-2chj-qfwxPublished
pgx: SQL Injection via placeholder confusion with dollar quoted string literals
osv · CVE-2026-41889 · GO-2026-5004
Go: github.com/jackc/pgx/v5 · Go: github.com/jackc/pgx/v4 · Go: github.com/jackc/pgx
GHSA-j6cv-3w8p-vrg8Published
KubeVirt's authorization mechanism improperly truncates subresource names
osv · CVE-2026-6383 · GO-2026-5450
Go: kubevirt.io/kubevirt
GHSA-qvw7-jm5c-6hqwPublished
Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability
osv · BIT-dotnet-2026-50528 · BIT-dotnet-sdk-2026-50528 · CVE-2026-50528
NuGet: Microsoft.NetCore.App.Runtime.linux-arm · NuGet: Microsoft.NetCore.App.Runtime.linux-arm64 · NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm
GHSA-j452-xhg8-qg39Published
Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution
osv · CVE-2026-5758
npm: protocol-buffers-schema
GHSA-hr2v-4r36-88hrPublished
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
osv · BIT-helm-2026-35206 · CVE-2026-35206 · GO-2026-5435
Go: helm.sh/helm/v4 · Go: helm.sh/helm/v3
GHSA-hwhf-8p2f-45wrWithdrawn
Duplicate Advisory: coreutils' comm utility silently corrupts data by performing lossy UTF-8 conversion on all output lines
osv ·
crates.io: coreutils
GHSA-hwr4-mq23-wcv5Published
mercure has Topic Selector Cache Key Collision
osv · CVE-2026-39972 · GO-2026-5444
Go: github.com/dunglas/mercure
GHSA-hpfw-mqm3-33jhPublished
uutils coreutils has a Link Following issue
osv · CVE-2026-35359
crates.io: coreutils
GHSA-hj9r-8pfm-rmjjWithdrawn
Duplicate Advisory: uutils coreutils has an Issue With its Always-Incorrect Control Flow Implementation
osv ·
crates.io: coreutils
GHSA-hfr4-7c6c-48w2Published
Wasmtime has use-after-free bug after cloning `wasmtime::Linker`
osv · CVE-2026-34983 · PYSEC-2026-151 · RUSTSEC-2026-0090
crates.io: wasmtime
GHSA-hffm-xvc3-vprcPublished
simple-git is vulnerable to Remote Code Execution
osv · CVE-2026-6951
npm: simple-git
GHSA-hc8w-h2mf-hp59Published
PowerShell Command Injection in Podman HyperV Machine
osv · CVE-2026-33414 · GO-2026-5421
Go: github.com/containers/podman/v4 · Go: github.com/containers/podman/v5
GHSA-hfvc-g4fc-pqhxPublished
opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
osv · CVE-2026-39883 · GO-2026-5426
Go: go.opentelemetry.io/otel/sdk
GHSA-gpcg-h6x2-c26pWithdrawn
Duplicate Advisory: uutils coreutils has an Improper Input Validation issue
osv ·
crates.io: coreutils
GHSA-gm9m-gwc4-hwgpPublished
Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution
osv · CVE-2026-34148
npm: @fedify/fedify · npm: @fedify/vocab-runtime · npm: @fedify/vocab-runtime
GHSA-gj49-89wh-h4gjPublished
Cillium exposes sensitive information included in the cilium-bugtool debug archive
osv · BIT-cilium-2026-41520 · BIT-cilium-operator-2026-41520 · BIT-hubble-relay-2026-41520 · CVE-2026-41520
Go: github.com/cilium/cilium · Go: github.com/cilium/cilium · Go: github.com/cilium/cilium
GHSA-gwhp-pf74-vj37Published
Fastify's connection header abuse enables stripping of proxy-added headers
osv · CVE-2026-33805
npm: @fastify/reply-from · npm: @fastify/http-proxy
GHSA-ggc5-46rg-mr4vWithdrawn
Duplicate Advisory: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
osv ·
crates.io: coreutils
GHSA-gh4j-gqv2-49f6Published
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
osv · CVE-2026-41650
npm: fast-xml-parser
GHSA-f9g8-6ppc-pqq4Published
Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
osv · BIT-kyverno-2026-41323 · CVE-2026-41323 · GO-2026-5351
Go: github.com/kyverno/kyverno
GHSA-f2jv-wjjc-2c94Published
uutils coreutils has an Uncaught Exception When Encountering Valid but Non-UTF-8 Paths
osv · CVE-2026-35348
crates.io: coreutils
GHSA-cvq5-hhx3-f99pPublished
Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)
osv · BIT-kyverno-2026-41068 · CVE-2026-41068 · GO-2026-5337
Go: github.com/kyverno/kyverno
GHSA-f984-pcp8-v2p7Published
Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend
osv · CVE-2026-35186 · RUSTSEC-2026-0094
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-f2g3-hh2r-cwgcPublished
Distribution: stale blob access resurrection via repo-scoped redis descriptor cache invalidation
osv · BIT-distribution-2026-35172 · CVE-2026-35172 · GO-2026-4942
Go: github.com/distribution/distribution/v3 · Go: github.com/distribution/distribution
GHSA-9gh9-hwpr-rvqqPublished
uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition
osv · CVE-2026-35352
crates.io: coreutils
GHSA-9gcg-w975-3rjhPublished
Istio: AuthorizationPolicy serviceAccounts regex injection via unescaped dots
osv · CVE-2026-39350 · GO-2026-5289
Go: istio.io/istio
GHSA-9gqx-53gp-c8g3Withdrawn
Duplicate Advisory: uutils coreutils allows users to bypass the --preserve-root safety mechanism
osv ·
crates.io: coreutils
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.