GHSA-g759-4pxw-6692Published
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
osv · CVE-2026-48032
npm: @hulumi/policies
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700913 source statements · aliases may refer to the same vulnerabilityGHSA-9ggv-8w38-r7pmPublished
TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)
osv ·
npm: typeorm
GHSA-f3m7-gqxr-g87xPublished
Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
osv · CVE-2026-50557
npm: @angular/core · npm: @angular/core · npm: @angular/core
GHSA-f38q-mgvj-vph7Published
protobufjs : Schema-derived names can shadow runtime-significant properties
osv · CVE-2026-54269
npm: protobufjs · npm: protobufjs-cli · npm: protobufjs-cli
GHSA-cvxm-645q-p574Published
containerd: CRI checkpoint import allows local image tag poisoning
osv · CVE-2026-50195 · GO-2026-5338
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd/v2
GHSA-f5mr-q85p-6hh6Published
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
osv · CVE-2026-49478 · GO-2026-5853
Go: github.com/sigstore/fulcio
GHSA-f5wc-c3c7-36mcPublished
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
osv · CVE-2026-39832 · GO-2026-5006
Go: golang.org/x/crypto
GHSA-9c54-x2g4-v92jPublished
Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality
osv · CVE-2026-49835 · GO-2026-5851
Go: github.com/sigstore/timestamp-authority/v2 · Go: github.com/sigstore/timestamp-authority
GHSA-f2r5-5m7w-p5cxPublished
opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
osv · CVE-2026-48496 · GO-2026-5343
Go: go.opentelemetry.io/ebpf-profiler
GHSA-98xf-r82g-9mhxPublished
LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access
osv · CVE-2026-48121
npm: @langchain/langgraph-checkpoint-mongodb
GHSA-9cr8-q42q-g8m7Published
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
osv · CVE-2026-53622 · GO-2026-5287
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik/v2 · Go: github.com/traefik/traefik
GHSA-f577-qrjj-4474Published
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
osv · CVE-2026-47673
npm: hono
GHSA-99f4-grh7-6pcqPublished
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
osv · CVE-2026-48069
npm: @grpc/grpc-js · npm: @grpc/grpc-js · npm: @grpc/grpc-js
GHSA-9g5q-2w5x-hmxfPublished
chi Middleware Vulnerable to Potential IP Spoofing via `X-Forwarded-For` Header in `Request.RemoteAddr` Resolution
osv · CVE-2026-72817 · GO-2026-5775
Go: github.com/go-chi/chi/middleware · Go: github.com/go-chi/chi/v2/middleware · Go: github.com/go-chi/chi/v3/middleware
GHSA-96hv-2xvq-fx4pPublished
ws: Memory exhaustion DoS from tiny fragments and data chunks
osv · CVE-2026-48779
npm: ws · npm: ws · npm: ws
GHSA-94rc-8x27-4472Published
protobufjs: Memory amplification from preserved unknown fields in binary decode
osv · CVE-2026-54270
npm: protobufjs
GHSA-8x6r-g9mw-2r78Published
React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint
osv · CVE-2026-42342
npm: react-router · npm: @remix-run/server-runtime
GHSA-g4vj-cjjj-v7hgPublished
Defense in Depth update for NuGet Client
osv ·
NuGet: NuGet.Packaging · NuGet: NuGet.Packaging · NuGet: NuGet.Packaging
GHSA-88fw-hqm2-52qcPublished
hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard
osv · CVE-2026-54290
npm: hono
GHSA-8988-4f7v-96qfPublished
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
osv · CVE-2026-54285
npm: @opentelemetry/core
GHSA-89gr-r52h-f8rxPublished
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
osv · CVE-2026-39831 · GO-2026-5019
Go: golang.org/x/crypto
GHSA-777c-7fjr-54vfPublished
Allocation of Resources Without Limits or Throttling in Axios
osv · CVE-2026-44488
npm: axios
GHSA-7c78-jf6q-g5cmPublished
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
osv · CVE-2026-49982
npm: tmp
GHSA-7gh7-258j-4mpqPublished
@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper
osv · CVE-2026-46672
npm: @actual-app/cli
GHSA-6xp4-cf37-ppjhPublished
Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign
osv · CVE-2026-48150
npm: @budibase/server
GHSA-76mc-f452-cxcmPublished
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
osv · CVE-2026-65902
npm: dompurify
GHSA-6xff-cpcq-vpw2Published
Grafana Tempo vulnerable to an out-of-memory crash
osv · CVE-2026-27878 · GO-2026-6325
Go: github.com/grafana/tempo
GHSA-76g7-m3xw-x9grPublished
MCP Toolbox for Databases has an Origin Validation Error
osv · CVE-2026-11624 · GO-2026-6288
Go: github.com/googleapis/mcp-toolbox
GHSA-5xrq-8626-4rwpPublished
When Vitest UI server is listening, arbitrary file can be read and executed
osv · CVE-2026-47429
npm: vitest · npm: vitest
GHSA-698x-9w2p-7vvpPublished
Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints
osv · CVE-2026-10517 · GO-2026-5939
Go: github.com/quay/claircore
GHSA-64mm-vxmg-q3vjPublished
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
osv · CVE-2026-55602
npm: http-proxy-middleware · npm: http-proxy-middleware · npm: http-proxy-middleware
GHSA-692r-grfm-v8x7Published
@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)
osv · CVE-2026-52725
npm: @angular/core · npm: @angular/core · npm: @angular/core
GHSA-63gr-g7jc-v8rgPublished
@agenticmail/mcp Missing Authentication for Critical Function
osv · CVE-2026-50287
npm: @agenticmail/mcp
GHSA-4x5r-pxfx-6jf8Published
@babel/core: Arbitrary File Read via sourceMappingURL Comment
osv · CVE-2026-49356
npm: @babel/core · npm: @babel/core
GHSA-5cgq-3rg8-m6cvPublished
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
osv · CVE-2026-42508 · GO-2026-5021
Go: golang.org/x/crypto
GHSA-4x76-22x2-rx8vPublished
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
osv · CVE-2026-48054
npm: @openzeppelin/wizard
GHSA-5375-pq7m-f5r2Published
@grpc/grpc-js: A malformed request can cause a server crash
osv · CVE-2026-48068
npm: @grpc/grpc-js · npm: @grpc/grpc-js · npm: @grpc/grpc-js
GHSA-jvgr-9ph5-m8v4Published
ImageMagick has a heap buffer overflow when encoding JXL image with a 16-bit float
osv · CVE-2026-40183
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-4mr2-fg2p-w63cPublished
Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
osv · CVE-2026-54762 · GO-2026-5128
Go: github.com/traefik/traefik/v3
GHSA-4q6h-8p4v-67vqPublished
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
osv · CVE-2026-48153
npm: @budibase/server
GHSA-xchc-cqwg-g76qPublished
Argo has Missing Authorization in its Sync ConfigMap Provider
osv · BIT-argo-workflows-2026-42297 · CVE-2026-42297 · GO-2026-5751
Go: github.com/argoproj/argo-workflows/v4
GHSA-49rj-9fvp-4h2hPublished
React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE
osv · CVE-2026-42211
npm: react-router
GHSA-4936-9hrh-qqpwPublished
@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels
osv · CVE-2026-54074
npm: @tinacms/cli
GHSA-xhjh-pmcv-23jwPublished
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
osv · CVE-2026-42040
npm: axios · npm: axios
GHSA-48r7-hpm6-gfxmPublished
@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)
osv · CVE-2026-54268
npm: @angular/common · npm: @angular/common · npm: @angular/common
GHSA-x494-mj8g-cj27Published
gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data
osv · CVE-2026-82254
crates.io: gix-pack
GHSA-x3x5-7h4h-gwxgPublished
HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack
osv · CVE-2026-46511
npm: @haxtheweb/haxcms-nodejs
GHSA-x86f-5xw2-fm2rPublished
Docker: `PUT /containers/{id}/archive` executes container binary on the host
osv · CVE-2026-41567 · GO-2026-5746
Go: github.com/moby/moby/v2 · Go: github.com/docker/docker · Go: github.com/moby/moby
GHSA-wv26-88m5-6h59Published
External Secrets Operator has Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore
osv · CVE-2026-42875 · GO-2026-5723
Go: github.com/external-secrets/external-secrets
GHSA-wfc6-r584-vfw7Published
Next.js vulnerable to cache poisoning in React Server Component responses
osv · CVE-2026-44576
npm: next · npm: next
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.