GHSA-wgpf-jwqj-8h8pPublished
hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
osv · CVE-2026-54289
npm: hono
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700913 source statements · aliases may refer to the same vulnerabilityGHSA-w879-237q-wc7rPublished
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
osv · CVE-2026-39829 · GO-2026-5018
Go: golang.org/x/crypto
GHSA-w9wp-h8wv-79jxPublished
opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation
osv · CVE-2026-48504
crates.io: opentelemetry_sdk
GHSA-vvgj-x9jq-8cj9Published
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
osv · CVE-2026-40898 · GO-2026-5676
Go: github.com/quic-go/quic-go
GHSA-w7jw-789q-3m8pPublished
shell-quote quote() does not escape newlines in object .op values
osv · CVE-2026-9277
npm: shell-quote
GHSA-7q4v-2mr6-5gpxPublished
Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability
osv · BIT-dotnet-2026-45491 · BIT-dotnet-sdk-2026-45491 · CVE-2026-45491
NuGet: Microsoft.NETCore.App.Runtime.linux-x64 · NuGet: Microsoft.NETCore.App.Runtime.linux-x64 · NuGet: Microsoft.NETCore.App.Runtime.linux-x64
GHSA-v6wh-96g9-6wx3Published
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
osv · CVE-2026-53632
npm: launch-editor · npm: vite · npm: vite
GHSA-hv8m-jj95-wg3xPublished
MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
osv · CVE-2026-48109
NuGet: MessagePack · NuGet: MessagePack
GHSA-v75r-vx73-82pjPublished
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument
osv · CVE-2026-55849
npm: @cyclonedx/cyclonedx-npm
GHSA-v52w-28xh-v562Published
Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)
osv ·
npm: kozou · npm: @kozou/api · npm: @kozou/mcp
GHSA-rp72-5v5q-2446Published
@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url
osv ·
npm: @cardano402/mcp-server
GHSA-rv63-4mwf-qqc2Published
hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`
osv · CVE-2026-54288
npm: hono
GHSA-rm3j-f69w-wqmqPublished
golang.org/x/crypto vulnerable to infinite loop on large channel writes
osv · CVE-2026-39834 · GO-2026-5020
Go: golang.org/x/crypto
GHSA-rp4v-qc77-phm4Published
Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel
osv · CVE-2026-3433 · GO-2026-6286
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server
GHSA-rhgj-6g2c-frmmPublished
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
osv · CVE-2026-48033
npm: @hulumi/policies
GHSA-rcvq-m9j9-6f4gPublished
@hapi/inert has a static-file confinement bypass via sibling-prefix path
osv · CVE-2026-48049
npm: @hapi/inert
GHSA-rp9w-3fw7-7cwqPublished
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
osv · CVE-2026-49978
npm: dompurify
GHSA-rgjc-h3x7-9mwgPublished
Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
osv · CVE-2026-54267
npm: @angular/core · npm: @angular/core · npm: @angular/core
GHSA-rjr7-jggh-pgcpPublished
chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header
osv · CVE-2026-72816 · GO-2026-5777
Go: github.com/go-chi/chi/middleware · Go: github.com/go-chi/chi/v2/middleware · Go: github.com/go-chi/chi/v3/middleware
GHSA-rgh6-rfwx-v388Published
Arbitrary host CRI log file read via symlink following in CRI checkpoint restore
osv · CVE-2026-53489 · GO-2026-5622
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd/v2
GHSA-qwjm-9c66-w4q4Published
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat
osv · CVE-2026-22551
npm: @theia/ai-chat-ui · npm: @theia/ai-chat · npm: @theia/ai-claude-code
GHSA-qpw4-5x99-6vjpPublished
golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS
osv · CVE-2026-39827 · GO-2026-5016
Go: golang.org/x/crypto
GHSA-qvv5-jq5g-4cggPublished
Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload
osv · CVE-2026-48063
npm: baileys · npm: @whiskeysockets/baileys · npm: baileys
GHSA-qw24-gh76-8rvvPublished
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
osv · BIT-rclone-2026-49980 · CVE-2026-49980 · GO-2026-5596
Go: github.com/rclone/rclone
GHSA-qvqc-4c52-x6qpPublished
regclient may leak authentication credentials to external blob stores
osv · CVE-2026-49349 · GO-2026-5822
Go: github.com/regclient/regclient
GHSA-qhv3-wjg8-6fx6Published
Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema
osv · CVE-2026-48151
npm: @budibase/server
GHSA-q7cg-457f-vx79Published
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
osv · CVE-2026-48038
npm: joi · npm: joi
GHSA-q4h4-gmj2-qvw2Published
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
osv · CVE-2026-46597 · GO-2026-5013
Go: golang.org/x/crypto
GHSA-qcm7-3vpr-hj5hPublished
@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754
osv · CVE-2026-48795
npm: @adonisjs/bodyparser · npm: @adonisjs/bodyparser
GHSA-pr59-h9ph-3fr8Published
protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names
osv · CVE-2026-54271
npm: protobufjs-cli · npm: protobufjs-cli
GHSA-q6f4-qqrg-jv6xPublished
@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache
osv · CVE-2026-50170
npm: @angular/common · npm: @angular/common · npm: @angular/common
GHSA-jpcc-p29g-p8mqPublished
containerd image-triggered runtime DoS via unbounded group parsing
osv · CVE-2026-47262 · GO-2026-5475
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
GHSA-jppx-rxg9-jmrxPublished
golang.org/x/crypto doesn't enforce invoking key constraints
osv · CVE-2026-39833 · GO-2026-5005
Go: golang.org/x/crypto
GHSA-j5f8-grm9-p9fcPublished
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
osv · CVE-2026-44486
npm: axios · npm: axios
GHSA-j6c9-x7qj-28xfPublished
hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice
osv · CVE-2026-54287
npm: hono
GHSA-hpcv-96wg-7vj8Published
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
osv · CVE-2026-49458
npm: dompurify
GHSA-7gg8-qqx7-92g5Published
ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion
osv · CVE-2026-46522
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-hm92-r4w5-c3mjPublished
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
osv · CVE-2026-6734
npm: undici · npm: undici
GHSA-hcxc-wf8j-23hvPublished
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
osv · CVE-2026-55689 · GO-2026-5423
Go: github.com/openfga/openfga
GHSA-hmw2-7cc7-3qxxPublished
form-data: CRLF injection in form-data via unescaped multipart field names and filenames
osv · CVE-2026-12143
npm: form-data · npm: form-data · npm: form-data
GHSA-h668-6x6g-f8r5Published
tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx
osv · CVE-2026-55832
crates.io: tract-onnx · crates.io: tract-onnx · crates.io: tract-onnx
GHSA-hfxv-24rg-xrqfPublished
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
osv · CVE-2026-44496
npm: axios · npm: axios
GHSA-h67p-54hq-rp68Published
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
osv · CVE-2026-53550
npm: js-yaml · npm: js-yaml
GHSA-gvmj-g25r-r7wrPublished
DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
osv · CVE-2026-65900
npm: dompurify
GHSA-h5jc-78hr-3pc9Published
Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe
osv ·
npm: @sveltia/cms
GHSA-g4w6-vmgf-xqvxPublished
@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
osv · CVE-2026-49473
npm: @cedar-policy/authorization-for-expressjs
GHSA-g5qx-h5f3-mp2fPublished
TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover
osv · CVE-2026-55660
npm: tinacms · npm: @tinacms/app
GHSA-g7r4-m6w7-qqqrPublished
esbuild allows arbitrary file read when running the development server on Windows
osv ·
npm: esbuild
GHSA-g6qx-g4pr-92v7Published
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
osv · CVE-2026-48146
npm: @budibase/server
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.