GHSA-w8j3-pq8g-8m7wPublished
iskorotkov/avro: CPU Exhaustion in Decoder
osv · CVE-2026-46385 · GO-2026-5046
Go: github.com/iskorotkov/avro/v2
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700913 source statements · aliases may refer to the same vulnerabilityGHSA-wfhv-mj62-f5xhPublished
Grafana: Users can generate Service Account tokens after permissions removal
osv · BIT-grafana-2026-33381 · CVE-2026-33381 · GO-2026-5708
Go: github.com/grafana/grafana
GHSA-wjjv-3mj2-39hfPublished
AgenticMail API/storage and outbound relay hardening fixes
osv · CVE-2026-47255
npm: @agenticmail/api · npm: @agenticmail/core
GHSA-w9j2-pvgh-6h63Published
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
osv · CVE-2026-42041
npm: axios · npm: axios
GHSA-w9m9-85wc-3x92Published
postcss-selector-parser allows denial of service through uncontrolled AST recursion
osv · CVE-2026-9358
npm: postcss-selector-parser · npm: postcss-selector-parser
GHSA-vfvv-c25p-m7mmPublished
rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
osv · RUSTSEC-2026-0122
crates.io: rkyv
GHSA-vhjm-w67q-g75cPublished
@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects
osv · CVE-2026-44979
npm: @hapi/wreck
GHSA-vf2m-468p-8v99Published
Axios: HTTP adapter streamed responses bypass maxContentLength
osv · CVE-2026-42036
npm: axios · npm: axios
GHSA-vfv6-92ff-j949Published
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
osv · CVE-2026-44582
npm: next · npm: next
GHSA-v39h-62p7-jpjcPublished
fast-uri vulnerable to host confusion via percent-encoded authority delimiters
osv · CVE-2026-6322
npm: fast-uri · npm: fast-uri
GHSA-v2v4-37r5-5v8gPublished
ip-address has XSS in Address6 HTML-emitting methods
osv · CVE-2026-42338
npm: ip-address
GHSA-v8vw-gw5j-w7m6Published
MCP Registry has open redirect via protocol-relative path in trailing-slash middleware
osv · CVE-2026-44427 · GO-2026-5658
Go: github.com/modelcontextprotocol/registry
GHSA-rg2x-37c3-w2rhPublished
Docker: Race condition in docker cp allows bind mount redirection to host path
osv · CVE-2026-42306 · GO-2026-5617
Go: github.com/docker/docker · Go: github.com/moby/moby/v2 · Go: github.com/moby/moby
GHSA-rg3g-4rw9-gqrpPublished
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
osv · BIT-argo-cd-2026-45737 · CVE-2026-45737 · GO-2026-5618
Go: github.com/argoproj/argo-cd/v3 · Go: github.com/argoproj/argo-cd/v3 · Go: github.com/argoproj/argo-cd/v3
GHSA-r7g9-xpmj-5fcqPublished
LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex
osv · CVE-2026-45617
npm: liquidjs
GHSA-qjx8-664m-686jPublished
JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection
osv · CVE-2026-46625
npm: js-cookie
GHSA-r8j5-8747-88cmPublished
@utcp/http: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol
osv · CVE-2026-45366
npm: @utcp/http
GHSA-qjv7-627w-8qjvPublished
Fiber vulnerable to XSS in AutoFormat Content Negotiation
osv · CVE-2026-42554 · GO-2026-5585
Go: github.com/gofiber/fiber/v3 · Go: github.com/gofiber/fiber/v2
GHSA-qp7p-654g-cw7pPublished
Hono has CSS Declaration Injection via Style Object Values in JSX SSR
osv · CVE-2026-44458
npm: hono
GHSA-pxh5-6rrc-8rjvPublished
OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server
osv · GO-2026-5558
Go: github.com/opentofu/opentofu
GHSA-p3hw-mv63-rf9wPublished
gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure
osv · CVE-2026-82253
crates.io: gix · crates.io: gix-validate
GHSA-h64f-5h5j-jqjhPublished
Next.js has a Denial of Service in the Image Optimization API
osv · CVE-2026-44577
npm: next · npm: next
GHSA-hcwr-pq9g-rq3mPublished
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
osv · CVE-2026-42575 · GO-2026-5422
Go: chainguard.dev/apko
GHSA-hcwq-x9fw-8cfqPublished
@apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
osv · CVE-2026-42853
npm: @apostrophecms/cli
GHSA-p4gq-3vxj-f4jqPublished
Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)
osv · BIT-argo-workflows-2026-42183 · CVE-2026-42183 · GO-2026-5527
Go: github.com/argoproj/argo-workflows/v4
GHSA-mx64-mj3q-7prjPublished
iskorotkov/avro: Denial-of-Service Vulnerability in Decoder
osv · GO-2026-5048
Go: github.com/iskorotkov/avro/v2
GHSA-hgv7-v322-mmgrPublished
@sveltejs/kit: `query.batch` cross-talk
osv · CVE-2026-82258
npm: @sveltejs/kit
GHSA-gxhx-2686-5h9gPublished
slack-go `SecretsVerifier` accepts empty signing secret without precondition
osv · GO-2026-5410
Go: github.com/slack-go/slack
GHSA-hcf7-66rw-9f5rPublished
Turbo: Login callback CSRF/session fixation
osv · CVE-2026-45773
npm: turbo
GHSA-g6ww-w5j2-r7x3Published
BoxLite: Permission Bypass Allows Modification of Read-Only Files
osv · CVE-2026-46695 · GO-2026-5392 · PYSEC-2026-299 · RUSTSEC-2026-0147
PyPI: boxlite · npm: @boxlite-ai/boxlite · Go: github.com/boxlite-ai/boxlite/sdks/go
GHSA-g43v-9x7q-83pqPublished
@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass
osv · CVE-2026-82861
npm: @hulumi/policies
GHSA-fx83-v9x8-x52wPublished
protobuf.js: Prototype injection in generated message constructors
osv · CVE-2026-44292
npm: protobufjs · npm: protobufjs
GHSA-g2g8-95qg-v35hPublished
HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpoint
osv · CVE-2026-48527
npm: @haxtheweb/haxcms-nodejs
GHSA-g27c-q7cp-mhx6Published
json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio
osv · CVE-2026-9673
npm: json-2-csv
GHSA-fgqv-jh4g-pvg2Published
Budibase: SSRF Bypass via HTTP Redirect in REST Datasource Integration
osv · CVE-2026-45715
npm: @budibase/server
GHSA-fvhg-p4hf-79x3Published
@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode
osv · CVE-2026-30691
npm: @cyntler/react-doc-viewer
GHSA-5xg3-585r-9jh5Published
ImageMagick has an off-by-one error in MSL decoder could result in crash
osv · CVE-2026-40312
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-f84p-cvgm-xgjjPublished
protobuf.js is Vulnerable to OS Command Injection in the CLI
osv · CVE-2026-42290
npm: protobufjs-cli · npm: protobufjs-cli
GHSA-fq7h-9x26-6j22Published
ExternalSecrets vulnerable to privilege escalation with secret overwriting
osv · CVE-2026-42876 · GO-2026-5377
Go: github.com/external-secrets/external-secrets/apis
GHSA-fp55-jw48-c537Published
astral-tokio-tar is Vulnerable to PAX Header Desynchronization
osv · RUSTSEC-2026-0112
crates.io: astral-tokio-tar
GHSA-fgmj-fm8m-jvvxPublished
Apache ECharts has a cross-site scripting (XSS) vulnerability
osv · CVE-2026-45249
npm: echarts
GHSA-5592-p365-24xhPublished
ImageMagick has a heap buffer overflow (WRITE) in the YAML and JSON encoders.
osv · CVE-2026-40169
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-cfw5-68c4-ffqpPublished
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
osv · CVE-2026-44680
npm: @mikro-orm/sql · npm: @mikro-orm/knex
GHSA-crhj-59gh-8x96Published
go-git: Crafted repositories may modify main and submodule .git directories
osv · CVE-2026-45571 · GO-2026-5336
Go: github.com/go-git/go-git/v5 · Go: github.com/go-git/go-git/v6 · Go: github.com/go-git/go-git
GHSA-9rfg-v8g9-9367Published
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring
osv · CVE-2026-42462
npm: @fedify/fedify · npm: @fedify/fedify · npm: @fedify/fedify
GHSA-c54j-xp92-wh28Published
Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration
osv · CVE-2026-45716
npm: @budibase/worker
GHSA-c567-44rc-m5hqPublished
@rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)
osv · CVE-2026-44483
npm: @rvf/set-get · npm: @rvf/set-get
GHSA-c4j6-fc7j-m34rPublished
Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
osv · CVE-2026-44578
npm: next · npm: next
GHSA-7j59-v9qr-6fq9Published
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
osv · CVE-2026-44503 · GO-2026-5224 · PYSEC-2026-2647
Maven: com.microsoft.kiota:microsoft-kiota-abstractions · NuGet: Microsoft.Kiota.Abstractions · PyPI: microsoft-kiota-http
GHSA-9vqf-7f2p-gf9vPublished
Hono: bodyLimit() can be bypassed for chunked / unknown-length requests
osv · CVE-2026-44456
npm: hono
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.