GHSA-7vf8-2cr6-54mfPublished
Argo vulnerable to exposure of artifact repository credentials
osv · BIT-argo-workflows-2026-42295 · CVE-2026-42295 · GO-2026-5235
Go: github.com/argoproj/argo-workflows/v4
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700913 source statements · aliases may refer to the same vulnerabilityGHSA-8rm2-7qqf-34qmPublished
Prometheus: Remote read endpoint allows denial of service via crafted snappy payload
osv · BIT-prometheus-2026-42154 · CVE-2026-42154 · GO-2026-5264
Go: github.com/prometheus/prometheus · Go: github.com/prometheus/prometheus · Go: github.com/prometheus/prometheus
GHSA-7rmh-48mx-2vwcPublished
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
osv · CVE-2026-44309 · GO-2026-5233
Go: github.com/sigstore/gitsign
GHSA-7jcp-v9w4-wjmgPublished
KubeVirt has a Link Following vulnerability
osv · CVE-2026-7374 · GO-2026-5848
Go: kubevirt.io/kubevirt · Go: kubevirt.io/kubevirt · Go: kubevirt.io/kubevirt
GHSA-79cf-xcqc-c78wPublished
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins
osv · CVE-2026-6402
npm: webpack-dev-server
GHSA-75px-5xx7-5xc7Published
protobuf.js: Code generation gadget after prototype pollution
osv · CVE-2026-44291
npm: protobufjs · npm: protobufjs
GHSA-7c37-gx6w-8vc5Published
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
osv · CVE-2026-44310 · GO-2026-5212
Go: github.com/sigstore/gitsign
GHSA-6pjf-3r9x-m592Published
Distribution's tag deletion bypasses `storage.delete.enabled` configuration
osv · BIT-distribution-2026-41888 · CVE-2026-41888 · GO-2026-5185
Go: github.com/distribution/distribution/v3 · Go: github.com/distribution/distribution
GHSA-6vp2-6r7m-2jvxPublished
Budibase: Missing Cache Invalidation on Public API Role Unassignment Allows Revoked Users to Retain Privileges for Up to 1 Hour
osv · CVE-2026-46424
npm: @budibase/backend-core
GHSA-6m6c-36f7-fhxhPublished
Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
osv · CVE-2026-41150
npm: mermaid · npm: mermaid
GHSA-6m7c-xfhp-p9fhPublished
Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder Preview
osv · CVE-2026-28445
npm: @typebot.io/js
GHSA-69xw-7hcm-h432Published
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection
osv · CVE-2026-44455
npm: hono
GHSA-6c8g-9hfh-pq5hPublished
HAXcms: Private Key Disclosure via Broken HMAC Implementation
osv · CVE-2026-46395
npm: @haxtheweb/haxcms-nodejs
GHSA-6r35-46g8-jcw9Published
protobuf.js: Code injection in pbjs static output from crafted schema names
osv · CVE-2026-44295
npm: protobufjs-cli · npm: protobufjs-cli
GHSA-6xwp-cp5h-q856Published
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
osv · CVE-2026-46412
npm: @beproduct/nestjs-auth
GHSA-654m-c8p4-x5fpPublished
Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix
osv · CVE-2026-44489
npm: axios
GHSA-67gq-6q8c-qqh6Published
Summarize contains a missing authorization vulnerability
osv · CVE-2026-45244
npm: @steipete/summarize
GHSA-5c9x-8gcm-mpgxPublished
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
osv · CVE-2026-42034
npm: axios · npm: axios
GHSA-66ff-xgx4-vchmPublished
protobuf.js: Code injection through bytes field defaults in generated toObject code
osv · CVE-2026-44293
npm: protobufjs · npm: protobufjs
GHSA-62hf-57xw-28j9Published
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
osv · CVE-2026-42039
npm: axios · npm: axios
GHSA-685m-2w69-288qPublished
protobuf.js: Denial of service through unbounded protobuf recursion
osv · CVE-2026-44289
npm: protobufjs · npm: protobufjs
GHSA-4xrh-5m3m-328wPublished
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
osv · CVE-2026-82860
npm: @hulumi/policies
GHSA-526f-jxpj-jmg2Published
Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption
osv · BIT-thrift-2026-43870 · CVE-2026-43870
npm: thrift
GHSA-5cv4-jp36-h3mwPublished
Go Net HTML parser is vulnerable to denial of service
osv · CVE-2026-25680 · GO-2026-5028
Go: golang.org/x/net
GHSA-423p-g724-fr39Published
CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE
osv · CVE-2026-44477 · GO-2026-5106
Go: github.com/cloudnative-pg/cloudnative-pg · Go: github.com/cloudnative-pg/cloudnative-pg
GHSA-4fg7-f244-3j49Published
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
osv · CVE-2026-46391
npm: @haxtheweb/open-apis
GHSA-4f8r-922h-2vgvPublished
js-libp2p: Memory DoS via subscription flood of unique topics
osv · CVE-2026-46679
npm: @libp2p/gossipsub
GHSA-3m4q-ggcj-j6m4Published
Calico Inserts Sensitive Information into Log File
osv · CVE-2026-6720 · GO-2026-5893
Go: github.com/projectcalico/calicoctl/v3
GHSA-3w6x-2g7m-8v23Published
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
osv · CVE-2026-42044
npm: axios
GHSA-445q-vr5w-6q77Published
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
osv · CVE-2026-42037
npm: axios
GHSA-3vcp-chfh-f6r2Published
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin
osv · CVE-2026-18676 · CVE-2026-45021 · GO-2026-5102
Go: github.com/kumahq/kuma · Go: github.com/kumahq/kuma · Go: github.com/kumahq/kuma
GHSA-2ffm-hxrq-qqmmPublished
@hulumi/drift: Orphan reconciler accepted externally supplied execute plans
osv · CVE-2026-82858
npm: @hulumi/drift
GHSA-27f5-xjrr-q9ffPublished
Malware in @opensearch-project/opensearch
osv ·
npm: @opensearch-project/opensearch · npm: @opensearch-project/opensearch · npm: @opensearch-project/opensearch
GHSA-xpg8-3hhp-p7w8Published
Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster
osv · CVE-2026-5199 · GO-2026-5766
Go: go.temporal.io/server · Go: go.temporal.io/server
GHSA-xphw-cqx3-667jPublished
thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics
osv · CVE-2026-6654 · RUSTSEC-2026-0103
crates.io: thin-vec
GHSA-x4mc-mqm7-gg39Published
uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition
osv · CVE-2026-35354
crates.io: coreutils
GHSA-x6wf-f3px-wcqxPublished
xmldom has XML node injection through unvalidated processing instruction serialization
osv · CVE-2026-41675
npm: @xmldom/xmldom · npm: @xmldom/xmldom · npm: xmldom
GHSA-xf75-659h-cgg5Published
uutils coreutils has a Link Following Issue
osv · CVE-2026-35345
crates.io: coreutils
GHSA-xpcf-pg52-r92gPublished
Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
osv · CVE-2026-39409
npm: hono
GHSA-xm5m-wgh2-rrg3Published
Sigstore Timestamp Authority has Improper Certificate Validation in verifier
osv · CVE-2026-39984 · GO-2026-5763
Go: github.com/sigstore/timestamp-authority/v2
GHSA-mr8r-92fq-pj8pPublished
OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling
osv · CVE-2026-40891
NuGet: OpenTelemetry.Exporter.OpenTelemetryProtocol
GHSA-xgrm-4fwx-7qm8Published
pgx contains memory-safety vulnerability
osv · CVE-2026-33815 · GO-2026-4771
Go: github.com/jackc/pgx/v5
GHSA-x99g-8v8j-25j2Published
Ollama is Vulnerable to Path Traversal
osv · CVE-2026-7020 · GO-2026-5750
Go: github.com/ollama/ollama
GHSA-xh5h-p8c5-4w4xWithdrawn
Duplicate Advisory: uutils coreutils has an Improper Handling of Unicode Encoding Issue
osv ·
crates.io: coreutils
GHSA-wh8p-h9hw-x2mcPublished
uutils coreutils has an Unchecked Return Value Issue
osv · CVE-2026-35344
crates.io: coreutils
GHSA-p5rh-vmhp-gvcwPublished
Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
osv · CVE-2026-34976 · GO-2026-5529
Go: github.com/dgraph-io/dgraph/v25 · Go: github.com/dgraph-io/dgraph/v24 · Go: github.com/dgraph-io/dgraph
GHSA-p4r4-xvrq-gvmcPublished
Grafana Tempo has an Uncontrolled Resource Consumption issue
osv · CVE-2026-21728 · GO-2026-5528
Go: github.com/grafana/tempo · Go: github.com/grafana/tempo · Go: github.com/grafana/tempo
GHSA-v273-448j-v4qjPublished
LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read
osv · CVE-2026-39859
npm: liquidjs
GHSA-wmmm-f939-6g9cPublished
Hono: Middleware bypass via repeated slashes in serveStatic
osv · CVE-2026-39407
npm: hono
GHSA-v24v-f45g-w7jfWithdrawn
Duplicate Advisory: uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition
osv ·
crates.io: coreutils
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.