GHSA-rjcw-vg7j-m9rcPublished
Syft improper temporary file cleanup
osv · CVE-2026-33481 · GO-2026-4809
Go: github.com/anchore/syft
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700913 source statements · aliases may refer to the same vulnerabilityGHSA-r9w3-57w2-gch2Published
Ory Hydra has a SQL injection via forged pagination tokens
osv · CVE-2026-33504 · GO-2026-4807
Go: github.com/ory/hydra · Go: github.com/ory/hydra/v2
GHSA-r275-fr43-pm7qPublished
simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE
osv · CVE-2026-28292
npm: simple-git
GHSA-qffp-2rhf-9h96Published
tar has Hardlink Path Traversal via Drive-Relative Linkpath
osv · CVE-2026-29786
npm: tar
GHSA-q4r8-xm5f-56gwPublished
step-ca has Unauthenticated Certificate Issuance via SCEP UpdateReq (MessageType=18)
osv · CVE-2026-30836 · GO-2026-4775
Go: github.com/smallstep/certificates
GHSA-pxq6-2prw-chj9Published
Moby has an Off-by-one error in its plugin privilege validation
osv · CVE-2026-33997 · GO-2026-4883
Go: github.com/docker/docker · Go: github.com/moby/moby/v2 · Go: github.com/moby/moby
GHSA-qj8w-gfj5-8c6vPublished
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
osv · CVE-2026-34043
npm: serialize-javascript
GHSA-q5qw-h33p-qvwrPublished
Hono vulnerable to arbitrary file access via serveStatic vulnerability
osv · CVE-2026-29045
npm: hono
GHSA-q8m4-xhhv-38mgPublished
etcd: Authorization bypasses in multiple APIs
osv · BIT-etcd-2026-33413 · CVE-2026-33413 · GO-2026-4806
Go: go.etcd.io/etcd/v3 · Go: go.etcd.io/etcd/v3 · Go: go.etcd.io/etcd/v3
GHSA-q29p-9pfr-j652Published
libcrux-sha3: Incorrect output from SHAKE squeeze functions
osv · RUSTSEC-2026-0074
crates.io: libcrux-sha3
GHSA-q382-vc8q-7jhjPublished
Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
osv · GO-2026-4770
Go: github.com/modelcontextprotocol/go-sdk
GHSA-q67f-28xg-22rwPublished
Forge has signature forgery in Ed25519 due to missing S > L check
osv · CVE-2026-33895
npm: node-forge
GHSA-pwx7-fx9r-hr4hPublished
NATS Server: Incomplete Stripping of Nats-Request-Info Header Allows Identity Spoofing
osv · BIT-nats-2026-33223 · CVE-2026-33223 · GO-2026-4835
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server
GHSA-pq2q-rcw4-3hr6Published
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead
osv · BIT-nats-2026-27889 · CVE-2026-27889 · GO-2026-4841
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server
GHSA-pcgw-qcv5-h8chPublished
Unsigned SAML LogoutRequest Acceptance in gosaml2
osv · GO-2026-4764
Go: github.com/russellhaering/gosaml2
GHSA-phc3-fgpg-7m6hPublished
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
osv · CVE-2026-2581
npm: undici
GHSA-p6xx-57qc-3wxrPublished
Hono Vulnerable to SSE Control Field Injection via CR/LF in writeSSE()
osv · CVE-2026-29085
npm: hono
GHSA-p77j-4mvh-x3m3Published
gRPC-Go has an authorization bypass via missing leading slash in :path
osv · CVE-2026-33186 · GO-2026-4762
Go: google.golang.org/grpc
GHSA-p747-qc5p-773rPublished
Vikunja has TOTP Reuse During Validity Window
osv · CVE-2026-33473 · GO-2026-4805
Go: code.vikunja.io/api
GHSA-mfg5-7q5g-f37jPublished
OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure
osv · CVE-2026-32062
npm: openclaw · npm: @openclaw/voice-call
GHSA-p436-gjf2-799pPublished
Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows
osv · BIT-docker-cli-2025-15558 · CVE-2025-15558 · GO-2026-4610
Go: github.com/docker/cli
GHSA-jp2q-39xq-3w4gPublished
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
osv · CVE-2026-33349
npm: fast-xml-parser · npm: fast-xml-parser
GHSA-jhf3-xxhw-2wppPublished
go-git: Maliciously crafted idx file can cause asymmetric memory consumption
osv · CVE-2026-34165 · GO-2026-4910
Go: github.com/go-git/go-git/v5
GHSA-j5q5-j9gm-2w5cPublished
Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod
osv · CVE-2026-33211 · GO-2026-4761
Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline
GHSA-hhfx-wfvq-7g9cPublished
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
osv · CVE-2026-26118 · PYSEC-2026-2669
NuGet: Azure.Mcp · NuGet: Azure.Mcp · npm: @azure/mcp
GHSA-hxv8-4j4r-cqgvPublished
Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic
osv · BIT-cilium-2026-33726 · BIT-cilium-operator-2026-33726 · BIT-hubble-relay-2026-33726 · CVE-2026-33726
Go: github.com/cilium/cilium · Go: github.com/cilium/cilium · Go: github.com/cilium/cilium
GHSA-j3q9-mxjg-w52fPublished
path-to-regexp vulnerable to Denial of Service via sequential optional groups
osv · CVE-2026-4926
npm: path-to-regexp
GHSA-j4xf-2g29-59phPublished
tar-rs `unpack_in` can chmod arbitrary directories by following symlinks
osv · CVE-2026-33056 · RUSTSEC-2026-0067
crates.io: tar
GHSA-j47w-4g3g-c36vPublished
file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry
osv · CVE-2026-32630
npm: file-type
GHSA-xgm3-v4r9-wfgmPublished
Image Magick has a Memory Leak in coders/ashlar.c
osv · CVE-2026-25969
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-hwqm-qvj9-4jr2Published
gosaml2 CBC Padding Panic — Unauthenticated Process Crash
osv · GO-2026-4760
Go: github.com/russellhaering/gosaml2
GHSA-hfpc-8r3f-gw53Published
AWS-LC has PKCS7_verify Signature Validation Bypass
osv · CVE-2026-3338 · GHSA-jchq-39cv-q4wj · RUSTSEC-2026-0047
crates.io: aws-lc-sys
GHSA-h6c8-cww8-35hfPublished
OpenFGA has an Authorization Bypass through cached keys
osv · CVE-2026-33729 · GO-2026-4857
Go: github.com/openfga/openfga
GHSA-h6c2-x2m2-mwhfPublished
nginx-ui's Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
osv · CVE-2026-33032 · GO-2026-4904
Go: github.com/0xJacky/Nginx-UI
GHSA-h75p-j8xm-m278Published
CoreDNS Loop Detection Denial of Service Vulnerability
osv · CVE-2026-26018 · GO-2026-4635
Go: github.com/coredns/coredns
GHSA-gqf8-rvrh-g7w6Published
Rancher cloud credentials can be used through proxy API by users without access
osv · CVE-2021-25320 · GO-2026-4589
Go: github.com/rancher/rancher · Go: github.com/rancher/rancher
GHSA-gchp-q4r4-x4ffPublished
tar-rs incorrectly ignores PAX size headers if header size is nonzero
osv · CVE-2026-33055 · RUSTSEC-2026-0068
crates.io: tar
GHSA-ggv3-7p47-pfv8Published
Next.js: HTTP request smuggling in rewrites
osv · CVE-2026-29057
npm: next · npm: next
GHSA-g2pf-ww5m-2r9mPublished
Zitadel is missing enforcement of organization scopes
osv · CVE-2026-33132 · GO-2026-4751
Go: github.com/zitadel/zitadel · Go: github.com/zitadel/zitadel · Go: github.com/zitadel/zitadel
GHSA-f269-vfmq-vjvjPublished
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
osv · CVE-2026-1528
npm: undici · npm: undici
GHSA-c9v3-4pv7-87prPublished
CoreDNS ACL Bypass
osv · CVE-2026-26017 · GO-2026-4630
Go: github.com/coredns/coredns
GHSA-cv4x-93xx-wgfjPublished
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun
osv · CVE-2026-33022 · GO-2026-4730
Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline · Go: github.com/tektoncd/pipeline
GHSA-cp8r-8jvw-v3qgPublished
nginx-ui Vulnerable to DoS via Negative Integer Input in Logrotate Interval
osv · CVE-2026-33029 · GO-2026-4902
Go: github.com/0xJacky/Nginx-UI
GHSA-c8gq-rhqh-wgwmWithdrawn
Duplicate Advisory: .NET Denial of Service Vulnerability
osv ·
NuGet: Microsoft.Bcl.Memory
GHSA-9f94-5g5w-gf6rPublished
CRL Distribution Point Scope Check Logic Error in AWS-LC
osv · CVE-2026-4428 · RUSTSEC-2026-0042 · RUSTSEC-2026-0048
crates.io: aws-lc-fips-sys · crates.io: aws-lc-sys
GHSA-c7w3-x93f-qmm8Published
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
osv · CVE-2026-82854
npm: nodemailer
GHSA-9ppj-qmqm-q256Published
node-tar Symlink Path Traversal via Drive-Relative Linkpath
osv · CVE-2026-31802
npm: tar
GHSA-8q2w-wr49-whqjPublished
Traefik: kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values
osv · CVE-2026-29777 · GO-2026-4679
Go: github.com/traefik/traefik/v3 · Go: github.com/traefik/traefik · Go: github.com/traefik/traefik/v2
GHSA-8r68-gvr4-jh7jPublished
NATS is vulnerable to pre-auth DoS through WebSockets client service
osv · BIT-nats-2026-33219 · CVE-2026-33219 · GO-2026-4831
Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server/v2 · Go: github.com/nats-io/nats-server
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.