GHSA-2328-f5f3-gj25Published
Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)
osv · CVE-2026-33896
npm: node-forge
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700914 source statements · aliases may refer to the same vulnerabilityGHSA-27v5-c462-wpq7Published
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
osv · CVE-2026-4923
npm: path-to-regexp
GHSA-wvj2-96wp-fq3fPublished
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
osv · CVE-2026-27896 · GO-2026-4569
Go: github.com/modelcontextprotocol/go-sdk
GHSA-wwj6-vghv-5p64Published
Kata Container to Guest micro VM privilege escalation
osv · CVE-2026-24834 · GO-2026-4517
Go: github.com/kata-containers/kata-containers/src/runtime
GHSA-wfqv-66vq-46rmPublished
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped
osv · BIT-cosign-2026-24122 · CVE-2026-24122 · GO-2026-4529
Go: github.com/sigstore/cosign
GHSA-xh87-mx6m-69f3Published
Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo
osv · CVE-2026-27700
npm: hono
GHSA-w7fw-mjwx-w883Published
qs's arrayLimit bypass in comma parsing allows denial of service
osv · CVE-2026-2391
npm: qs
GHSA-w4gw-w5jq-g9jhPublished
golang.org/x/net/html has a Quadratic Parsing Complexity issue
osv · CVE-2025-47911 · GO-2026-4440
Go: golang.org/x/net/html
GHSA-vhvq-fv9f-wh4qPublished
LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic
osv · GO-2026-4465
Go: github.com/authzed/spicedb
GHSA-v34v-rq6j-cj6pPublished
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
osv · CVE-2026-25528 · PYSEC-2026-2584
PyPI: langsmith · npm: langsmith
GHSA-vqqr-rmpc-hhg2Published
melange pipeline working-directory could allow command injection
osv · CVE-2026-24844 · GO-2026-4408
Go: chainguard.dev/melange
GHSA-vm32-vv63-w422Published
jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)
osv · CVE-2026-24043
npm: jspdf
GHSA-rf4g-89h5-crcrPublished
melange affected by potential host command execution via license-check YAML mode patch pipeline
osv · CVE-2026-25143 · GO-2026-4412
Go: chainguard.dev/melange
GHSA-r6v5-fh4h-64xcPublished
time vulnerable to stack exhaustion Denial of Service attack
osv · CVE-2026-25727 · RUSTSEC-2026-0009
crates.io: time
GHSA-rrxv-pmq9-x67rPublished
uTLS has a fingerprint vulnerability from missing padding extension for Chrome 120
osv · CVE-2026-26995 · GO-2026-4512
Go: github.com/refraction-networking/utls
GHSA-phwv-c562-gvmhPublished
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
osv · CVE-2026-27901
npm: svelte
GHSA-mphv-75cg-56wgPublished
LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader
osv · CVE-2026-27795
npm: @langchain/community
GHSA-p5xg-68wr-hm3mPublished
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
osv · CVE-2026-25940
npm: jspdf
GHSA-mrq8-rjmw-wpq3Published
Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
osv · CVE-2026-25882 · GO-2026-4543
Go: github.com/gofiber/fiber/v2 · Go: github.com/gofiber/fiber/v3
GHSA-mw96-cpmx-2vgcPublished
Rollup 4 has Arbitrary File Write via Path Traversal
osv · CVE-2026-27606
npm: rollup · npm: rollup · npm: rollup
GHSA-m7jm-9gc2-mpf2Published
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
osv · CVE-2026-25896
npm: fast-xml-parser · npm: fast-xml-parser
GHSA-7rvh-xqp3-pr8jPublished
ImageMagick's failure to limit MVG mutual causes Stack Overflow
osv · CVE-2025-68950
NuGet: Magick.NET-Q16-AnyCPU · NuGet: Magick.NET-Q16-HDRI-AnyCPU · NuGet: Magick.NET-Q16-HDRI-OpenMP-arm64
GHSA-j39j-6gw9-jw6hPublished
git2 has potential undefined behavior when dereferencing Buf struct
osv · RUSTSEC-2026-0008
crates.io: git2
GHSA-jmr7-xgp7-cmfjPublished
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
osv · CVE-2026-26278
npm: fast-xml-parser · npm: fast-xml-parser
GHSA-m56q-vw4c-c2cpPublished
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
osv · CVE-2026-27122
npm: svelte
GHSA-jq9f-gm9w-rwm9Published
OpenFGA Improper Policy Enforcement
osv · CVE-2026-24851 · GO-2026-4446
Go: github.com/openfga/openfga
GHSA-h395-gr6q-cpjcPublished
jsonwebtoken has Type Confusion that leads to potential authorization bypass
osv · CVE-2026-25537
crates.io: jsonwebtoken
GHSA-gx3x-vq4p-mhhvPublished
cert-manager-controller DoS via Specially Crafted DNS Response
osv · BIT-cert-manager-2026-25518 · CVE-2026-25518 · GO-2026-4399
Go: github.com/cert-manager/cert-manager · Go: github.com/cert-manager/cert-manager
GHSA-gq3j-xvxp-8hrfPublished
Hono added timing comparison hardening in basicAuth and bearerAuth
osv · CVE-2026-56764
npm: hono
GHSA-gf3v-fwqg-4vh7Published
@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation
osv · CVE-2026-26019
npm: @langchain/community
GHSA-g6x7-jq8p-6q9qPublished
webtransport-go: Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule
osv · CVE-2026-21434 · GO-2026-4485
Go: github.com/quic-go/webtransport-go
GHSA-gcqf-3g44-vc9pPublished
[actix-files] Panic triggered by empty Range header in GET request for static file
osv · CVE-2026-72813
crates.io: actix-files
GHSA-fw7p-63qq-7hprPublished
filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity
osv · CVE-2026-26958 · GO-2026-4503
Go: filippo.io/edwards25519
GHSA-9h8m-3fm2-qjrqPublished
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
osv · CVE-2026-24051 · GO-2026-4394
Go: go.opentelemetry.io/otel/sdk
GHSA-crpf-4hrx-3jrpPublished
Svelte SSR attribute spreading includes inherited properties from prototype chain
osv · CVE-2026-27125
npm: svelte
GHSA-f7gr-6p89-r883Published
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
osv · CVE-2026-27121
npm: svelte
GHSA-fj3w-jwp8-x2g3Published
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
osv · CVE-2026-27942
npm: fast-xml-parser · npm: fast-xml-parser
GHSA-f229-3862-4942Published
@enclave-vm/core is vulnerable to Sandbox Escape
osv · CVE-2026-27597
npm: @enclave-vm/core
GHSA-9f3f-wv7r-qc8rPublished
Pion DTLS's usage of random nonce generation with AES GCM ciphers risks leaking the authentication key
osv · CVE-2026-26014 · GO-2026-4479
Go: github.com/pion/dtls/v3 · Go: github.com/pion/dtls/v2 · Go: github.com/pion/dtls
GHSA-9h3p-52vh-959wPublished
ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx
osv · CVE-2026-1580 · GO-2026-4423
Go: k8s.io/ingress-nginx · Go: k8s.io/ingress-nginx
GHSA-9f29-v6mm-pw6wPublished
opa-envoy-plugin has an Authorization Bypass via Double-Slash Path Misinterpretation in input.parsed_path
osv · CVE-2026-26205 · GO-2026-4506
Go: github.com/open-policy-agent/opa-envoy-plugin
GHSA-95fx-jjr5-f39cPublished
jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder
osv · CVE-2026-24133
npm: jspdf
GHSA-8fgc-7cc6-rx7xPublished
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
osv · CVE-2025-68458
npm: webpack
GHSA-8v2v-wjwg-vx6rPublished
actix-files has a possible exposure of information vulnerability
osv · CVE-2026-72814
crates.io: actix-files
GHSA-9c88-49p5-5ggfPublished
Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path
osv · CVE-2026-26280
npm: systeminformation
GHSA-83g3-92jg-28cxPublished
Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
osv · CVE-2026-26960
npm: tar
GHSA-852m-cvvp-9p4wPublished
Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
osv · CVE-2026-27204 · RUSTSEC-2026-0020
crates.io: wasmtime · crates.io: wasmtime · crates.io: wasmtime
GHSA-7r86-cg39-jmmjPublished
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
osv · CVE-2026-27903
npm: minimatch · npm: minimatch · npm: minimatch
GHSA-89p3-4642-cr2wPublished
Traefik: TCP readTimeout bypass via STARTTLS on Postgres
osv · CVE-2026-25949 · GO-2026-4484
Go: github.com/traefik/traefik/v3
GHSA-7m29-f4hw-g2vxPublished
uTLS has a fingerprint vulnerability from GREASE ECH mismatch for Chrome parrots
osv · CVE-2026-27017 · GO-2026-4509
Go: github.com/refraction-networking/utls
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.