GHSA-mmx7-hfxf-jppxPublished
Axios: Prototype pollution gadgets can alter axios request construction
osv · CVE-2026-67316
npm: axios · npm: axios
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700913 source statements · aliases may refer to the same vulnerabilityGHSA-m99w-x7hq-7vfjPublished
Next.js: Denial of Service in App Router using Server Actions
osv · CVE-2026-64641
npm: next · npm: next
GHSA-jxr7-mqhw-9p98Published
K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression
osv · CVE-2026-54250 · GO-2026-5973
Go: github.com/k3s-io/k3s · Go: github.com/k3s-io/k3s · Go: github.com/k3s-io/k3s
GHSA-jxpm-75mh-9fp7Published
oras-go blob upload vulnerable to credential forwarding via unvalidated Location header
osv · CVE-2026-50151 · GO-2026-5882
Go: oras.land/oras-go/v2
GHSA-m28w-2pqf-7qgjPublished
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
osv · CVE-2026-14631
npm: webpack-dev-server
GHSA-jqh4-m9w3-8hp9Published
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
osv · CVE-2026-67317
npm: axios
GHSA-hhx9-57xq-r5rwPublished
@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key
osv · CVE-2026-48819
npm: @hey-api/openapi-ts
GHSA-g8r8-53c2-pm3fPublished
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability
osv · BIT-dotnet-2026-47304 · BIT-dotnet-sdk-2026-47304 · CVE-2026-47304
NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml
GHSA-h8fp-f39c-q6mhPublished
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
osv · CVE-2026-53667
npm: react-router
GHSA-gvwx-54wh-qm9jPublished
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records
osv · CVE-2026-59875
npm: tar
GHSA-g9hv-x236-4qp3Published
Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
osv · CVE-2026-73429
crates.io: russh
GHSA-gcjh-h69q-9w9gPublished
cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag
osv · GO-2026-6094
Go: github.com/google/cel-go
GHSA-g6v3-7xmc-w563Published
GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS
osv · CVE-2026-54332 · GO-2026-6122
Go: github.com/gopacket/gopacket
GHSA-gcfj-64vw-6mp9Published
Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning
osv · CVE-2026-67320
npm: axios · npm: axios
GHSA-gcfq-8gqf-4876Published
GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
osv · CVE-2026-45045 · GO-2026-5887
Go: github.com/gofiber/fiber/v3 · Go: github.com/gofiber/fiber/v2
GHSA-frrj-87jh-2772Published
GoBGP confederation validation panics on empty AS_PATH attribute
osv · CVE-2026-49838 · GO-2026-5954
Go: github.com/osrg/gobgp/v4
GHSA-frvp-7c67-39w9Published
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
osv ·
npm: @hono/node-server · npm: @hono/node-server
GHSA-g3xr-5w5j-w4q4Published
Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled
osv · BIT-contour-2026-50149 · CVE-2026-50149 · GO-2026-5889
Go: github.com/projectcontour/contour
GHSA-g35j-m5xg-vh3qPublished
webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules
osv · CVE-2026-57497 · GO-2026-6099
Go: github.com/quic-go/webtransport-go
GHSA-fxhp-mv3v-67qpPublished
`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution
osv · CVE-2026-50163 · GO-2026-5880
Go: oras.land/oras-go/v2
GHSA-f9ff-5x35-7gfwPublished
Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)
osv ·
npm: @grackle-ai/mcp · npm: @grackle-ai/plugin-core · npm: @grackle-ai/auth
GHSA-f5vj-f2hx-8m93Published
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
osv · CVE-2026-14620
npm: webpack-dev-server
GHSA-f4gw-2p7v-4548Published
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
osv · CVE-2026-67315
npm: axios · npm: axios
GHSA-fpg8-7664-jc5qPublished
melange: Incomplete package integrity verification allows data section substitution
osv · CVE-2026-54174 · GO-2026-5968
Go: chainguard.dev/apko · Go: chainguard.dev/melange
GHSA-vg35-5wq7-3x7wPublished
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection
osv · CVE-2026-47761
npm: tinymce · npm: tinymce · npm: tinymce
GHSA-8882-frvv-92w4Published
@asymmetric-effort/specifyjs: URL parse failure silently allows request
osv · CVE-2026-50288
npm: @asymmetric-effort/specifyjs
GHSA-7rqj-j65f-68whPublished
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
osv · CVE-2026-73420
npm: @auth/core · npm: next-auth · npm: next-auth
GHSA-89xv-2m56-2m9xPublished
Next.js: Server-Side Request Forgery in Server Actions on custom servers
osv · CVE-2026-64649
npm: next · npm: next
GHSA-6w3m-4hhp-775qPublished
KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping
osv · CVE-2026-53572 · GO-2026-5940
Go: github.com/kedacore/keda/v2
GHSA-724g-mxrg-4qvmPublished
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
osv · CVE-2026-59870
npm: js-yaml
GHSA-4c39-4ccg-62r3Published
Next.js: Unbounded Server Action payload in Edge runtime
osv · CVE-2026-64646
npm: next · npm: next
GHSA-4633-3j49-mh5qPublished
Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
osv · CVE-2026-64647
npm: next · npm: next
GHSA-35rm-7j9c-2f7mPublished
async-tar PAX extension-header desync enables tar entry/content smuggling
osv · CVE-2026-53600
crates.io: async-tar
GHSA-34rh-wp3j-6cxcPublished
Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
osv · CVE-2026-54909 · GO-2026-6163
Go: github.com/pion/stun/v3 · Go: github.com/pion/stun/v2 · Go: github.com/pion/stun
GHSA-45rx-2jwx-cxfrPublished
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
osv · CVE-2026-59892
npm: @opentelemetry/propagator-jaeger
GHSA-337j-9hxr-rhxgPublished
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
osv · CVE-2026-53666
npm: react-router
GHSA-2vg6-77g8-24mpPublished
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
osv · CVE-2026-67334
npm: better-auth · npm: @better-auth/scim
GHSA-322x-v876-g883Published
@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write
osv ·
npm: @asymmetric-effort/nogginlessdom
GHSA-2v37-7h3g-55p8Published
nanoid: custom generators can loop indefinitely when size is zero
osv · CVE-2026-67213
npm: nanoid · npm: nanoid
GHSA-x426-x7cc-3fpcPublished
@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects
osv · CVE-2026-48022
npm: @hapi/wreck
GHSA-x5mv-8wgw-29hgPublished
tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load
osv · CVE-2026-55093 · RUSTSEC-2026-0217
crates.io: tract-nnef · crates.io: tract-nnef · crates.io: tract-nnef
GHSA-x4vx-rjvf-j5p4Published
DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
osv · CVE-2026-65901
npm: dompurify
GHSA-28wg-ghj8-5hjvPublished
nanoid: non-secure generators can loop indefinitely with negative size
osv · CVE-2026-67214
npm: nanoid · npm: nanoid
GHSA-2944-57xv-2682Published
@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction
osv ·
npm: @asymmetric-effort/specifyjs
GHSA-x527-x647-q7ggPublished
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
osv · CVE-2026-46595 · GO-2026-5023
Go: golang.org/x/crypto
GHSA-rcr6-g7jc-f57gPublished
ImageMagick: Stack overflow in fx operation
osv · CVE-2026-46557
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-wqvq-jvpq-h66fPublished
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
osv · CVE-2026-82660
npm: nodemailer
GHSA-wwfh-h76j-fc44Published
hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
osv · CVE-2026-54286
npm: hono
GHSA-wwf9-7jrc-rv4qPublished
Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure
osv · CVE-2026-55650
npm: @outerbase/studio
GHSA-wxq7-x3qp-vcr8Published
Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker
osv · CVE-2026-48147
npm: @budibase/backend-core
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.