GHSA-mf24-chxh-hmvjPublished
Envoy Gateway Log Injection Vulnerability
osv · BIT-envoy-gateway-2025-25294 · CVE-2025-25294 · GO-2025-3504
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700913 source statements · aliases may refer to the same vulnerabilityGHSA-m4gq-fm9h-8q75Published
buildx allows a possible credential leakage to telemetry endpoint
osv · CVE-2025-0495 · GO-2025-3527
Go: github.com/docker/buildx
GHSA-mh63-6h87-95cpPublished
jwt-go allows excessive memory allocation during header parsing
osv · CVE-2025-30204 · GO-2025-3553
Go: github.com/golang-jwt/jwt/v5 · Go: github.com/golang-jwt/jwt/v4 · Go: github.com/golang-jwt/jwt
GHSA-46mp-8w32-6g94Published
Kyverno ignores subjectRegExp and IssuerRegExp
osv · BIT-kyverno-2025-29778 · CVE-2025-29778 · GO-2025-3562
Go: github.com/kyverno/kyverno
GHSA-jr5f-v2jv-69x6Published
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
osv · CVE-2025-27152
npm: axios · npm: axios
GHSA-572q-86rr-5vgqWithdrawn
Withdrawn Advisory: Umbraco Rich Text Display allows Cross-Site Scripting
osv · CVE-2024-55488
NuGet: Umbraco.Cms.Infrastructure
GHSA-3wgm-2gw2-vh5mPublished
Kubernetes GitRepo Volume Inadvertent Local Repository Access
osv · CVE-2025-1767 · GO-2025-3521
Go: k8s.io/kubernetes
GHSA-2xf2-gjm6-g2c6Published
Ollama Divide by Zero Vulnerability
osv · CVE-2024-8063 · GO-2025-3689
Go: github.com/ollama/ollama
GHSA-37wc-h8xc-5hc4Published
Hickory DNS's DNSSEC validation may accept broken authentication chains
osv · CVE-2025-25188
crates.io: hickory-proto
GHSA-h78m-j95m-5356Published
Cilium has an information leakage via insecure default Hubble UI CORS header
osv · BIT-cilium-2025-23047 · BIT-cilium-operator-2025-23047 · BIT-hubble-relay-2025-23047 · CVE-2025-23047
Go: github.com/cilium/cilium · Go: github.com/cilium/cilium · Go: github.com/cilium/cilium
GHSA-fqmf-w4xh-33rhPublished
gix-worktree-state nonexclusive checkout sets executable files world-writable
osv · CVE-2025-22620 · RUSTSEC-2025-0001
crates.io: gix-worktree-state
GHSA-c76h-2ccp-4975Published
Use of Insufficiently Random Values in undici
osv · CVE-2025-22150
npm: undici · npm: undici · npm: undici
GHSA-274v-mgcv-cm8jPublished
Argo CD GitOps Engine does not scrub secret values from patch errors
osv · GO-2025-3437
Go: github.com/argoproj/gitops-engine · Go: github.com/argoproj/gitops-engine
GHSA-7rgp-4j56-fm79Published
Mattermost has Improper Check for Unusual or Exceptional Conditions
osv · CVE-2025-22445 · GO-2025-3380
Go: github.com/mattermost/mattermost/server/v8 · Go: github.com/mattermost/mattermost/server/v8
GHSA-c9p4-xwr9-rfhxPublished
Zot IdP group membership revocation ignored
osv · CVE-2025-23208 · GO-2025-3409
Go: zotregistry.dev/zot
GHSA-2549-xh72-qrpmPublished
Mattermost Improper Validation of Specified Type of Input vulnerability
osv · CVE-2025-20033 · GO-2025-3379
Go: github.com/mattermost/mattermost/server/v8 · Go: github.com/mattermost/mattermost/server/v8 · Go: github.com/mattermost/mattermost/server/v8
GHSA-8655-xgh5-5vvqPublished
fast-fault has a segmentation fault due to lack of bound check
osv · RUSTSEC-2025-0003
crates.io: fast-float
GHSA-6wxm-mpqj-6jpfPublished
Insecure Temporary File usage in github.com/golang/glog
osv · CVE-2024-45339 · GO-2025-3372
Go: github.com/golang/glog
GHSA-v778-237x-gjrcPublished
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
osv · CVE-2024-45337 · GO-2024-3321
Go: golang.org/x/crypto
GHSA-rhx6-c78j-4q9wPublished
path-to-regexp contains a ReDoS
osv · CVE-2024-52798
npm: path-to-regexp
GHSA-ghw8-3xqw-hhcjWithdrawn
Duplicate Advisory: cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs
osv · CVE-2024-12401
Go: github.com/cert-manager/cert-manager · Go: github.com/cert-manager/cert-manager · Go: github.com/cert-manager/cert-manager
GHSA-vm32-9rqf-rh3rPublished
pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion
osv · CVE-2024-53866
npm: pnpm
GHSA-9j3m-fr7q-jxfwPublished
Beego has Collision Hazards of MD5 in Cache Key Filenames
osv · CVE-2024-55885 · GO-2024-3331
Go: github.com/beego/beego · Go: github.com/beego/beego/v2
GHSA-qf5v-rp47-55ggPublished
Path Traversal in file update API in gogs
osv · CVE-2024-55947 · GO-2024-3356
Go: gogs.io/gogs
GHSA-2m9h-r57g-45pjPublished
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
osv · CVE-2024-54132 · GO-2024-3310
Go: github.com/cli/cli/v2 · Go: github.com/cli/cli
GHSA-9jmp-j63g-8x6mWithdrawn
Withdrawn Advisory: Lunary information disclosure vulnerability
osv · CVE-2024-6867
npm: lunary
GHSA-59hf-mpf8-pqjhPublished
Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events
osv · BIT-mattermost-2024-47003 · CVE-2024-47003 · GO-2024-3164
Go: github.com/mattermost/mattermost/server/v8
GHSA-chgm-7r52-whjjPublished
Hashicorp Consul Path Traversal vulnerability
osv · BIT-consul-2024-10005 · CVE-2024-10005 · GO-2024-3243
Go: github.com/hashicorp/consul
GHSA-2326-pfpj-vx3hPublished
lexical-core has multiple soundness issues
osv · RUSTSEC-2023-0086
crates.io: lexical-core
GHSA-vwf8-q6fw-4wcmPublished
Cilium leaks information via incorrect ReferenceGrant update logic in Gateway API
osv · BIT-cilium-2024-42486 · BIT-cilium-operator-2024-42486 · BIT-hubble-relay-2024-42486 · CVE-2024-42486
Go: github.com/cilium/cilium · Go: github.com/cilium/cilium
GHSA-rpcc-p8xm-rc6pPublished
Podman vulnerable to memory-based denial of service
osv · CVE-2024-3056 · GO-2024-3042
Go: github.com/containers/podman/v5 · Go: github.com/containers/podman · Go: github.com/containers/podman/v2
GHSA-r5ph-4jxm-6j9pPublished
LF Edge eKuiper has a SQL Injection in sqlKvStore
osv · CVE-2024-43406 · GO-2024-3078 · PYSEC-2024-72
Go: github.com/lf-edge/ekuiper · PyPI: ekuiper
GHSA-9v98-6g37-x9g6Published
deepstream is vulnerable to prototype pollution
osv · CVE-2026-49252
npm: @deepstream/server
GHSA-rpfr-3m35-5vx5Published
Hono CSRF middleware can be bypassed using crafted Content-Type header
osv · CVE-2024-43787
npm: hono
GHSA-3vmp-whvv-5v9vPublished
Mattermost doesn't validate that a username returned during bot registration belongs to a bot account
osv · CVE-2026-6046 · GO-2026-6279
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server
GHSA-9m57-25v3-79x9Published
golang.org/x/crypto: Invoking pathological inputs can lead to client panic
osv · CVE-2026-46598 · GO-2026-5033
Go: golang.org/x/crypto
GHSA-rqv2-m695-f8j4Published
MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`
osv · CVE-2026-44429 · GO-2026-5637
Go: github.com/modelcontextprotocol/registry
GHSA-2vcc-5v34-9jc8Published
TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes
osv · CVE-2026-55661
npm: tinacms · npm: @tinacms/mdx
GHSA-39pv-4j6c-2g6vPublished
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning
osv · CVE-2026-54266
npm: @angular/common · npm: @angular/common · npm: @angular/common
GHSA-2j2x-hqr9-3h42Published
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation
osv · CVE-2026-40181
npm: react-router · npm: react-router · npm: @remix-run/router
GHSA-396q-4vc8-28x9Published
@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter
osv · CVE-2026-49336
npm: @microsoft/kiota-http-fetchlibrary
GHSA-3jww-hxqj-wfq2Published
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
osv · CVE-2026-44688
npm: @theia/ai-chat-ui · npm: @theia/ai-chat · npm: @theia/ai-claude-code
GHSA-c28q-m4gf-vg4qPublished
Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation
osv · CVE-2026-6689 · GO-2026-6283
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server
GHSA-3hrh-pfw6-9m5xPublished
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
osv · CVE-2026-47675
npm: hono
GHSA-9vc9-4jv3-rf86Published
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
osv · CVE-2026-48034
npm: @hulumi/policies
GHSA-q862-gcgq-5m6gPublished
HAXcms createSite SSRF Enables Arbitrary File Read
osv · CVE-2026-46393
npm: @haxtheweb/haxcms-nodejs
GHSA-3gp5-q4jw-3v94Published
Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL
osv · CVE-2026-48152
npm: @budibase/server
GHSA-q6x5-8v7m-xcrfPublished
protobufjs has overlong UTF-8 decoding
osv · CVE-2026-44288
npm: protobufjs · npm: protobufjs · npm: @protobufjs/utf8
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.