GHSA-957r-r8gc-vv3hPublished
uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries
osv · CVE-2026-35351
crates.io: coreutils
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700901 source statements · aliases may refer to the same vulnerabilityGHSA-92mm-2pjq-r785Published
HashiCorp's go-getter library may allow arbitrary file reads
osv · CVE-2026-4660 · GO-2026-5058
Go: github.com/hashicorp/go-getter
GHSA-95mq-xwj4-r47pPublished
Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints
osv · CVE-2026-40173 · GO-2026-5274
Go: github.com/dgraph-io/dgraph/v25 · Go: github.com/dgraph-io/dgraph/v24 · Go: github.com/dgraph-io/dgraph
GHSA-94jr-7pqp-xhcqPublished
Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
osv · CVE-2026-40938 · GO-2026-5272
Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline
GHSA-92pp-h63x-v22mPublished
@hono/node-server: Middleware bypass via repeated slashes in serveStatic
osv · CVE-2026-39406
npm: @hono/node-server
GHSA-8r5m-3f66-qpr3Published
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
osv · BIT-vault-2026-5052 · CVE-2026-5052 · GO-2026-5262
Go: github.com/hashicorp/vault
GHSA-vh8f-65qg-3m8jWithdrawn
Duplicate Advisory: .NET Denial of Service Vulnerability
osv ·
NuGet: Microsoft.AspNetCore.App.Runtime.linux-arm
GHSA-85gx-3qv6-4463Published
Dapr: Service Invocation path traversal ACL bypass
osv · CVE-2026-41491 · GO-2026-5242
Go: github.com/dapr/dapr · Go: github.com/dapr/dapr · Go: github.com/dapr/dapr
GHSA-497x-rrr9-68jpPublished
Grafana Loki Path Traversal - CVE-2021-36156 Bypass
osv · CVE-2026-21726 · GO-2026-5115
Go: github.com/grafana/loki/v3
GHSA-2wpx-qpw2-g5h5Published
CoreDNS' DoQ worker pool does not bound stream backlog
osv · CVE-2026-32934 · GO-2026-4969
Go: github.com/coredns/coredns
GHSA-2m8x-mvfx-gwgjPublished
uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
osv · CVE-2026-35357
crates.io: coreutils
GHSA-x6gf-mpr2-68h6Withdrawn
Duplicate Advisory: pgproto3: Negative field length panics in DataRow.Decode
osv · CVE-2026-4427
Go: github.com/jackc/pgproto3/v2
GHSA-vpq2-c234-7xj6Published
@tootallnate/once vulnerable to Incorrect Control Flow Scoping
osv · CVE-2026-3449
npm: @tootallnate/once · npm: @tootallnate/once
GHSA-x6g4-f6q3-fqvvPublished
NATS credentials are exposed in monitoring port via command-line argv
osv · BIT-nats-2026-33247 · CVE-2026-33247 · GO-2026-4827
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2
GHSA-xf7r-hgr6-v32pPublished
Multer vulnerable to Denial of Service via incomplete cleanup
osv · CVE-2026-3304
npm: multer
GHSA-qpx9-hpmf-5gmwPublished
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
osv · CVE-2026-27601
npm: underscore
GHSA-vprv-35vv-q339Published
NATS has pre-auth server panic via leafnode handling
osv · BIT-nats-2026-33218 · CVE-2026-33218 · GO-2026-4837
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server
GHSA-mr9r-mww3-v6gvPublished
SVG Injection via Unsanitized Options in @dicebear/core and @dicebear/initials
osv · CVE-2026-33311
npm: @dicebear/core · npm: @dicebear/core · npm: @dicebear/core
GHSA-qmpg-8xg6-ph5qPublished
Trix has a Stored XSS vulnerability through serialized attributes
osv · CVE-2026-73426
RubyGems: action_text-trix · npm: trix
GHSA-qqrv-2hch-83q4Withdrawn
Duplicate Advisory: Kyverno is vulnerable to server-side request forgery (SSRF)
osv ·
Go: github.com/kyverno/kyverno
GHSA-m547-hp4w-j6jxPublished
Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers
osv · CVE-2026-29794 · GO-2026-4791
Go: code.vikunja.io/api
GHSA-m468-xcm6-fxg4Published
nginx-ui has Race Condition that Leads to Persistent Data Corruption and Service Collapse
osv · CVE-2026-33028 · GO-2026-4906
Go: github.com/0xJacky/Nginx-UI · Go: github.com/uozi-tech/cosy
GHSA-m8p8-53vf-8357Published
Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation
osv · CVE-2026-33027 · GO-2026-4907
Go: github.com/0xJacky/Nginx-UI
GHSA-jxxm-27vp-c3m5Published
NATS allows MQTT clients to bypass ACL checks
osv · BIT-nats-2026-33217 · CVE-2026-33217 · GO-2026-4834
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server
GHSA-h8r8-wccr-v5f2Published
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
osv · CVE-2026-65914
npm: dompurify
GHSA-jqcq-xjh3-6g23Published
Denial of service in github.com/jackc/pgproto3/v2
osv · CVE-2026-32286 · GO-2026-4518
Go: github.com/jackc/pgproto3/v2
GHSA-f886-m6hf-6m8vPublished
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
osv · CVE-2026-33750
npm: brace-expansion · npm: brace-expansion · npm: brace-expansion
GHSA-fcjp-h8cc-6879Published
NATS is vulnerable to MQTT hijacking via Client ID
osv · BIT-nats-2026-33215 · CVE-2026-33215 · GO-2026-4833
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2
GHSA-fp4x-ggrf-wmc6Published
H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation
osv · CVE-2026-86205
npm: h3
GHSA-c2c7-rcm5-vvqjPublished
Picomatch has a ReDoS vulnerability via extglob quantifiers
osv · CVE-2026-33671
npm: picomatch · npm: picomatch · npm: picomatch
GHSA-ffqx-q65f-36jfPublished
Grafana Tempo has Inadequate Encryption Strength
osv · CVE-2026-28377 · GO-2026-5359
Go: github.com/grafana/tempo
GHSA-9cx6-37pm-9jffPublished
Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
osv · CVE-2026-33939
npm: handlebars
GHSA-9983-vrx2-fg9cPublished
NATS JetStream has an authorization bypass through its Management API
osv · BIT-nats-2026-33222 · CVE-2026-33222 · GO-2026-4832
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server
GHSA-7g92-g4vh-hp84Published
Grafana OSS: Authorization bypass allows users with Editor role to modify protected webhook URLs without permissions
osv · BIT-grafana-2026-21724 · CVE-2026-21724 · GO-2026-5219
Go: github.com/grafana/grafana
GHSA-qvhc-9v3j-5rfwPublished
Microsoft Security Advisory CVE-2026-21218 | .NET Security Feature Bypass Vulnerability
osv · BIT-dotnet-2026-21218 · BIT-dotnet-sdk-2026-21218 · CVE-2026-21218
NuGet: System.Security.Cryptography.Cose · NuGet: System.Security.Cryptography.Cose · NuGet: System.Security.Cryptography.Cose
GHSA-55h8-8g96-x4hjPublished
NATS: Leafnode connections allow spoofing of Nats-Request-Info identity headers
osv · BIT-nats-2026-33246 · CVE-2026-33246 · GO-2026-4830
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server
GHSA-67jx-r9pv-98rjPublished
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
osv · CVE-2026-32695 · GO-2026-4880
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v2
GHSA-69fq-xp46-6x23Published
Trivy ecosystem supply chain was briefly compromised
osv · CVE-2026-33634 · GO-2026-4919
Go: github.com/aquasecurity/trivy · GitHub Actions: aquasecurity/trivy-action · GitHub Actions: aquasecurity/setup-trivy
GHSA-52jh-2xxh-pwh6Published
NATS Server panic via malicious compression on leafnode port
osv · BIT-nats-2026-29785 · CVE-2026-29785 · GO-2026-4829
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server
GHSA-6g7g-w4f8-9c9xPublished
github.com/buger/jsonparser has a denial of service vulnerability
osv · CVE-2026-32285 · GO-2026-4514
Go: github.com/buger/jsonparser
GHSA-68j5-4m99-w9w9Published
File Browser has an Authorization Policy Bypass in Public Share Download Flow
osv · CVE-2026-32761 · GO-2026-4738
Go: https://github.com/filebrowser/filebrowser
GHSA-5528-5vmv-3xc2Published
Multer Vulnerable to Denial of Service via Uncontrolled Recursion
osv · CVE-2026-3520
npm: multer
GHSA-4vrq-3vrq-g6ggPublished
BuildKit Git URL subdir component can cause access to restricted files
osv · CVE-2026-33748 · GO-2026-4859
Go: github.com/moby/buildkit
GHSA-53p3-c7vp-4mccPublished
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
osv · CVE-2026-73427
npm: trix · RubyGems: action_text-trix
GHSA-qxx2-7h4c-83f4Published
melange QEMU runner could write files outside workspace directory
osv · CVE-2026-24843 · GO-2026-4407
Go: chainguard.dev/melange
GHSA-q9hv-hpm4-hj6xPublished
CIRCL has an incorrect calculation in secp384r1 CombinedMult
osv · CVE-2026-1229 · GO-2026-4550
Go: github.com/cloudflare/circl
GHSA-pqxr-3g65-p328Published
jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution
osv · CVE-2026-24737
npm: jspdf
GHSA-prjf-86w9-mfqvPublished
Angular i18n vulnerable to Cross-Site Scripting
osv · CVE-2026-27970
npm: @angular/core · npm: @angular/core · npm: @angular/core
GHSA-px4r-g4p3-hhqvPublished
webtransport-go: CloseWithError can block indefinitely
osv · CVE-2026-21435 · GO-2026-4488
Go: github.com/quic-go/webtransport-go
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.