GHSA-v2wj-q39q-566rPublished
Vite: `server.fs.deny` bypassed with queries
osv · CVE-2026-39364
npm: vite · npm: vite
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700913 source statements · aliases may refer to the same vulnerabilityGHSA-jxhv-7h78-9775Published
Wasmtime: Panic when transcoding misaligned utf-16 strings
osv · CVE-2026-34942 · RUSTSEC-2026-0092
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-mrxx-39g5-ph77Published
Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field
osv · CVE-2026-41327 · GO-2026-5516
Go: github.com/dgraph-io/dgraph/v25 · Go: github.com/dgraph-io/dgraph/v24 · Go: github.com/dgraph-io/dgraph
GHSA-m26v-hjq3-x245Withdrawn
Duplicate Advisory: uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition
osv ·
crates.io: coreutils
GHSA-jwvj-g8pc-cx45Published
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision
osv · CVE-2026-34972 · GO-2026-5483
Go: github.com/openfga/openfga
GHSA-jvpw-637p-h3pwPublished
File Browser has a Command Injection via Hook Runner
osv · CVE-2026-35585 · GO-2026-5481
Go: github.com/filebrowser/filebrowser/v2
GHSA-m2cx-gpqf-qf74Published
Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
osv · CVE-2026-40924 · GO-2026-5486
Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline
GHSA-r39q-jr8h-gcq2Published
ImageMagick has Integer Overflow leading to out of bounds write in SIXEL decoder
osv · CVE-2026-28493
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-jvff-x2qm-6286Published
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
osv · CVE-2026-41139 · GHSA-5v89-rwgr-qj6g
npm: mathjs
GHSA-jcxm-m3jx-f287Published
simple-git Affected by Command Execution via Option-Parsing Bypass
osv · CVE-2026-28291
npm: simple-git
GHSA-jfwf-28xr-xw6qPublished
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
osv · BIT-rclone-2026-41179 · CVE-2026-41179 · GO-2026-5466
Go: github.com/rclone/rclone
GHSA-g94r-2vxg-569jPublished
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
osv · CVE-2026-40894
NuGet: OpenTelemetry.Api · NuGet: OpenTelemetry.Extensions.Propagators
GHSA-jhxm-h53p-jm7wPublished
Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift
osv · CVE-2026-34971 · RUSTSEC-2026-0096
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-h7mw-gpvr-xq4mPublished
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
osv · CVE-2026-41240
npm: dompurify
GHSA-h8mm-c463-wjq3Published
CoreDNS' transfer stanza selection uses lexicographic compare (subzone ACL bypass)
osv · CVE-2026-33489 · GO-2026-5417
Go: github.com/coredns/coredns
GHSA-fvcv-3m26-pcqxPublished
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
osv · CVE-2026-40175
npm: axios · npm: axios
GHSA-fpjq-c37h-cqcvPublished
Kyverno Controller Denial of Service via forEach Mutation Panic
osv · BIT-kyverno-2026-41485 · CVE-2026-41485 · GO-2026-5374
Go: github.com/kyverno/kyverno · Go: github.com/kyverno/kyverno
GHSA-fgw5-hp8f-xfhcPublished
Istio: SSRF via RequestAuthentication jwksUri
osv · CVE-2026-41413 · GO-2026-5363
Go: istio.io/istio
GHSA-fw9q-39r9-c252Published
LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`
osv · CVE-2026-40190
npm: langsmith
GHSA-f6ww-3ggp-fr8hPublished
xmldom has XML injection through unvalidated DocumentType serialization
osv · CVE-2026-41674
npm: @xmldom/xmldom · npm: @xmldom/xmldom · npm: xmldom
GHSA-cq8v-f236-94qcPublished
Rand is unsound with a custom logger using rand::rng()
osv · RUSTSEC-2026-0097
crates.io: rand · crates.io: rand · crates.io: rand
GHSA-chqc-8p9q-pq6qPublished
basic-ftp has FTP Command Injection via CRLF
osv · CVE-2026-39983
npm: basic-ftp
GHSA-crv5-9vww-q3g8Published
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
osv · CVE-2026-41239
npm: dompurify
GHSA-cjmm-f4jc-qw8rPublished
DOMPurify ADD_ATTR predicate skips URI validation
osv · CVE-2026-65912
npm: dompurify
GHSA-73j8-2gch-69rqPublished
.NET Denial of Service Vulnerability
osv · BIT-dotnet-2026-26127 · BIT-dotnet-sdk-2026-26127 · CVE-2026-26127
NuGet: Microsoft.Bcl.Memory · NuGet: Microsoft.NetCore.App.Runtime.linux-arm · NuGet: Microsoft.NetCore.App.Runtime.linux-arm64
GHSA-9jj7-4m8r-rfcmPublished
Memory-safety vulnerability in github.com/jackc/pgx/v5.
osv · CVE-2026-33816 · GO-2026-4772
Go: github.com/jackc/pgx/v5
GHSA-88v5-9hxc-f85rPublished
HashiCorp Vault Vulnerable to Denial-of-Service via Unauthenticated Root Token Generation/Rekey Operations
osv · BIT-vault-2026-5807 · CVE-2026-5807 · GO-2026-5247
Go: github.com/hashicorp/vault
GHSA-cj63-jhhr-wcxvPublished
DOMPurify USE_PROFILES prototype pollution allows event handlers
osv · CVE-2026-65913
npm: dompurify
GHSA-c97m-vxhj-p7j6Published
goldmark vulnerable to Cross-site Scripting (XSS)
osv · CVE-2026-5160 · GO-2026-5320
Go: github.com/yuin/goldmark/renderer/html
GHSA-88ch-q68x-36v7Withdrawn
Duplicate Advisory: uutils coreutils has an Incorrect Check of Function Return Value
osv ·
crates.io: coreutils
GHSA-79rc-qpw3-jv92Withdrawn
Duplicate Advisory: uutils coreutils has an Improper Preservation of Permissions issue
osv ·
crates.io: coreutils
GHSA-7ccv-rp6m-rffrPublished
OpenBao's Certificate Authentication Allows Token Renewal With Different Certificate
osv · BIT-openbao-2026-39388 · CVE-2026-39388 · GO-2026-5213
Go: github.com/openbao/openbao
GHSA-78h2-9frx-2jm8Published
Go JOSE Panics in JWE decryption
osv · CVE-2026-34986 · GO-2026-4945
Go: github.com/go-jose/go-jose/v4 · Go: github.com/go-jose/go-jose/v3 · Go: github.com/go-jose/go-jose
GHSA-77fj-vx54-gvh7Published
Go Markdown has an Out-of-bounds Read in SmartypantsRenderer
osv · CVE-2026-40890 · GO-2026-5208
Go: github.com/gomarkdown/markdown
GHSA-737v-mqg7-c878Published
defu: Prototype pollution via `__proto__` key in defaults argument
osv · CVE-2026-35209
npm: defu
GHSA-7259-cwhx-3xx3Withdrawn
Duplicate Advisory: uutils coreutils has an Improper Check for Unusual or Exceptional Conditions
osv ·
crates.io: coreutils
GHSA-6wgr-89rj-399pPublished
Wasmtime has data leakage between pooling allocator instances
osv · CVE-2026-34988 · RUSTSEC-2026-0088
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-6jwv-w5xf-7j27Withdrawn
Withdrawn Advisory: go.etcd.io/bbolt affected by index out-of-range vulnerability
osv · CVE-2026-33817
Go: go.etcd.io/bbolt
GHSA-6hw5-45gm-fj88Published
@fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)
osv · CVE-2026-33808
npm: @fastify/express
GHSA-6vgr-cp5c-ffx3Published
OpenBao's SQL Injection in PostgreSQL database secrets engine
osv · BIT-openbao-2026-39946 · CVE-2026-39946 · GO-2026-5192
Go: github.com/openbao/openbao
GHSA-72gw-fmmr-c4r4Published
HashiCorp Vault May Expose Tokens to Auth Plugins Due to Incorrect Header Sanitization
osv · BIT-vault-2026-4525 · CVE-2026-4525 · GO-2026-5199
Go: github.com/hashicorp/vault
GHSA-h95r-c8c7-mrwxPublished
ImageMagick has heap-based buffer overflow in UHDR encoder
osv · CVE-2026-30931
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-66fx-fqv6-5wwxWithdrawn
Duplicate Advisory: uutils coreutils has a Link Following issue
osv ·
crates.io: coreutils
GHSA-6g8r-74qp-6859Published
uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
osv · CVE-2026-35376
crates.io: coreutils
GHSA-67hp-f6hq-2h6gWithdrawn
Duplicate Advisory: uutils coreutils Uses Incorrectly-Resolved Name or Reference
osv ·
crates.io: coreutils
GHSA-68m9-983m-f3v5Published
OpenFGA: Unauthenticated playground endpoint discloses preshared API key in HTML response
osv · CVE-2026-40293 · GO-2026-5170
Go: github.com/openfga/openfga
GHSA-5v4g-vw9x-h534Published
uutils coreutils has an Improper Input Validation Issue in its env Utility
osv · CVE-2026-35377
crates.io: coreutils
GHSA-63cw-r7xf-jmwrPublished
CoreDNS DoH GET oversized dns= query parameter causes pre-validation CPU and memory amplification
osv · CVE-2026-32936 · GO-2026-5164
Go: github.com/coredns/coredns
GHSA-37gx-xxp4-5rgxPublished
Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
osv · BIT-dotnet-2026-33116 · BIT-dotnet-sdk-2026-33116 · CVE-2026-33116
NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml · NuGet: System.Security.Cryptography.Xml
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.