GHSA-q98m-7w8c-w388Published
Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component
osv · BIT-kyverno-2026-44245 · CVE-2026-44245 · GO-2026-5577
Go: github.com/kyverno/policy-reporter-ui
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700913 source statements · aliases may refer to the same vulnerabilityGHSA-q8qp-cvcw-x6jjPublished
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
osv · CVE-2026-42264
npm: axios
GHSA-qw64-3x98-g7q2Published
go-billy has path traversal vulnerabilities
osv · CVE-2026-44973 · GO-2026-5597
Go: github.com/go-git/go-billy/v5 · Go: github.com/go-git/go-billy/v6
GHSA-3g6v-2r68-prfcPublished
Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose internal Traefik services
osv · CVE-2026-54761 · GO-2026-5083
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik
GHSA-m3xc-h892-ggx6Published
go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion
osv · CVE-2026-44740 · GO-2026-5490
Go: github.com/go-git/go-billy/v5 · Go: github.com/go-git/go-billy/v6
GHSA-3f62-qv96-4p78Published
@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
osv · CVE-2026-46700
npm: @actual-app/sync-server
GHSA-9v76-4qcc-frghPublished
Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability
osv · BIT-dotnet-2026-42899 · BIT-dotnet-sdk-2026-42899 · CVE-2026-42899
NuGet: Microsoft.AspNetCore.App.Runtime.win-arm · NuGet: Microsoft.AspNetCore.App.Runtime.win-arm64 · NuGet: Microsoft.AspNetCore.App.Runtime.win-x64
GHSA-c83g-rgw3-j3cxPublished
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
osv · CVE-2026-73089
npm: browserslist
GHSA-x5fp-wj9c-mxmxPublished
qs array-limit bypass via bracket-key comma parsing
osv · CVE-2026-82562
npm: qs
GHSA-p498-v437-472gPublished
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree
osv ·
npm: @humanfs/node
GHSA-jqff-g426-hqxpPublished
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
osv · CVE-2026-76172
npm: fast-uri · npm: fast-uri · npm: fast-uri
GHSA-g8qq-57p8-ggw5Published
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
osv · CVE-2026-84371
npm: sanitize-html
GHSA-fph4-wmhf-6fwfPublished
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
osv · CVE-2026-75899
npm: fast-uri · npm: fast-uri · npm: fast-uri
GHSA-x3g7-qrwc-f6c5Published
Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI
osv · CVE-2026-54162 · GO-2026-6270
Go: github.com/alexandre-daubois/ember
GHSA-w67g-5rqw-f597Published
Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key
osv · GO-2026-6278
Go: github.com/gorilla/websocket
GHSA-rrwh-6jrq-wp5vPublished
Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import
osv · CVE-2026-54061 · GO-2026-6261
Go: github.com/dgraph-io/dgraph/v25
GHSA-qgq7-7hm3-q39jPublished
go-git: Malicious reference names may modify files outside the reference storage
osv · CVE-2026-71557 · GO-2026-6214
Go: github.com/go-git/go-git/v5 · Go: github.com/go-git/go-git/v6
GHSA-hq66-cqwq-w95jPublished
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
osv · CVE-2026-16633
npm: pdfjs-dist
GHSA-j2g6-362q-6qc6Published
Velero vulnerable to file path traversal when extracting from backup's tarball
osv · CVE-2026-32637 · GO-2026-6259
Go: github.com/vmware-tanzu/velero
GHSA-hfg8-hc9c-6c3hPublished
moby/go-archive: Crafted tar archive can write outside the extraction directory
osv · BIT-docker-cli-2026-17106 · CVE-2026-17106 · GO-2026-6253
Go: github.com/moby/go-archive
GHSA-fxqj-rqcc-2cmpPublished
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
osv · CVE-2026-69153
npm: postcss
GHSA-7p4m-qxvv-g567Published
rclone: Local Encoding Path Traversal
osv · BIT-rclone-2026-71313 · CVE-2026-71313 · GO-2026-6186
Go: github.com/rclone/rclone
GHSA-7p8r-x3mc-p8w7Published
fast-uri vulnerable to host confusion via backslash authority introducer
osv · CVE-2026-18446
npm: fast-uri · npm: fast-uri · npm: fast-uri
GHSA-fqj3-h9pc-443hWithdrawn
Duplicate Advisory: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
osv ·
npm: axios
GHSA-5p4m-2wfm-xmqjPublished
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
osv ·
npm: js-yaml · npm: js-yaml
GHSA-4xrf-jv44-h6hhPublished
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
osv · CVE-2026-69198
npm: ip-address
GHSA-4vr5-p2gc-h23pPublished
rclone archive extract allows S3 destination prefix escape via crafted archive paths
osv · BIT-rclone-2026-59732 · CVE-2026-59732 · GO-2026-6185
Go: github.com/rclone/rclone
GHSA-54fx-42gc-7vw4Published
Hono: Algorithmic Complexity DoS in Language Middleware
osv · CVE-2026-71848
npm: hono
GHSA-4ww2-rjh2-xpv9Withdrawn
Duplicate Advisory: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
osv ·
npm: axios
GHSA-2m8v-j782-fhvrPublished
Socket.IO: Zero-attachment Memory Exhaustion
osv · CVE-2026-69185
npm: socket.io-parser · npm: socket.io-parser · npm: socket.io-parser
GHSA-2m8m-jhrm-w6j2Published
rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution
osv · BIT-rclone-2026-71312 · CVE-2026-71312 · GO-2026-6182
Go: github.com/rclone/rclone
GHSA-464c-974j-9xm6Published
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
osv · GO-2026-6093
npm: aws-cdk-lib · NuGet: Amazon.CDK.Lib · Maven: software.amazon.awscdk:aws-cdk-lib
GHSA-xf85-363p-868wPublished
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
osv · CVE-2026-48978 · GO-2026-5885
Go: oras.land/oras-go/v2 · Go: oras.land/oras-go
GHSA-xgm2-5f3f-mvvcPublished
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication
osv · CVE-2026-59897
npm: hono
GHSA-xg4h-6gfc-h4m8Published
etcd: Watch API authorization bypass via open-ended range requests
osv · BIT-etcd-2026-73499 · CVE-2026-73499 · GO-2026-6114
Go: go.etcd.io/etcd/v3 · Go: go.etcd.io/etcd/v3 · Go: go.etcd.io/etcd/v3
GHSA-x445-f3h2-j279Published
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
osv · CVE-2026-73419
npm: @auth/core · npm: next-auth · npm: next-auth
GHSA-f8h2-vmm9-qhj6Published
Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability
osv · BIT-aspnet-core-2026-45591 · BIT-dotnet-2026-45591 · BIT-dotnet-sdk-2026-45591 · CVE-2026-45591
NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64 · NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64 · NuGet: Microsoft.AspNetCore.App.Runtime.linux-x64
GHSA-x4hg-hfwf-p9mwPublished
@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation
osv ·
npm: @asymmetric-effort/nogginlessdom
GHSA-v422-hmwv-36x6Published
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
osv · CVE-2026-12590
npm: body-parser · npm: body-parser
GHSA-mmjf-rqrv-855vPublished
Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service Vulnerability
osv · BIT-dotnet-2026-50527 · BIT-dotnet-sdk-2026-50527 · CVE-2026-50527
NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml
GHSA-qwww-vcr4-c8h2Published
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
osv ·
npm: react-router · npm: react-router
GHSA-q8wf-6r8g-63chPublished
Next.js: Denial of Service in the Image Optimization API using SVGs
osv · CVE-2026-64644
npm: next · npm: next
GHSA-r277-6w6q-xmqwPublished
kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default
osv · CVE-2026-73501 · GO-2026-6095
Go: github.com/getkin/kin-openapi
GHSA-r28c-9q8g-f849Published
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
osv · CVE-2026-73646
npm: postcss
GHSA-q3fv-x8vg-qqm4Published
Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
osv · CVE-2026-54448 · GO-2026-5983
Go: github.com/aquasecurity/trivy
GHSA-mp7j-qc5w-4988Published
websocket-driver: Resource limit bypass via message compression
osv · CVE-2026-54490
npm: websocket-driver
GHSA-px8p-9vwx-vf98Published
fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
osv · CVE-2026-45820
npm: fflate · npm: fflate · npm: fflate
GHSA-mjqf-28ph-426hPublished
Logging operator has Fluentd configuration injection that allows remote code execution
osv · CVE-2026-54680 · GO-2026-6142
Go: github.com/kube-logging/logging-operator
GHSA-mhc6-2gfq-xx62Published
Rancher vulnerable to command injection through unsanitized YAML parameter
osv · CVE-2026-44939 · GO-2026-5875
Go: github.com/rancher/rancher · Go: github.com/rancher/rancher · Go: github.com/rancher/rancher
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.