GO-2026-6603Published
HTTP/2 server memory exhaustion due to Trailer headers in net/http
osv · BIT-golang-2026-78659 · CVE-2026-78659
Go: stdlib · Go: stdlib · Go: golang.org/x/net
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694815 source statements · aliases may refer to the same vulnerabilityGO-2026-6602Published
Checksum database bypass for golang.org/toolchain in cmd/go
osv · BIT-golang-2026-94447 · CVE-2026-94447
Go: toolchain
GO-2026-6613Published
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
osv · BIT-golang-2026-94439 · CVE-2026-94439
Go: stdlib
GHSA-48qf-xh34-q73rPublished
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
osv · BIT-mariadb-2026-107383 · BIT-mariadb-min-2026-107383 · BIT-mysql-client-2026-107383 · CVE-2026-107383
npm: mariadb · npm: mariadb · npm: mariadb
GO-2026-6604Published
Root.Mkdir(All) can follow junctions out of the root on Windows in os
osv · BIT-golang-2026-56857 · CVE-2026-56857
Go: stdlib
GO-2026-6601Published
Checksum bypass for golang.org/fips140 in cmd/go
osv · BIT-golang-2026-94444 · CVE-2026-94444
Go: toolchain
GO-2026-6611Published
Excessive CPU consumption from repeated initial window changes in net/http
osv · BIT-golang-2026-78669 · CVE-2026-78669
Go: stdlib · Go: stdlib · Go: golang.org/x/net
GO-2026-6607Published
Reject malformed ECH outer extension references in crypto/tls
osv · BIT-golang-2026-97031 · CVE-2026-97031
Go: stdlib
GO-2026-6600Published
Recognize yield as regexp preceder keyword in html/template
osv · BIT-golang-2026-97030 · CVE-2026-97030
Go: stdlib
MAL-2026-15918Published
Malicious code in @modss/baileys (npm)
osv · GHSA-4c9v-m7qm-2mpr
npm: @modss/baileys
MAL-2026-17872Published
Malicious code in @newspage/lib-ng-async-routes-ui (npm)
osv ·
npm: @newspage/lib-ng-async-routes-ui
MAL-2026-17356Published
Malicious code in @ikyyjee/ikkysingle (npm)
osv · GHSA-84vp-jj79-gp79
npm: @ikyyjee/ikkysingle
MAL-2026-17873Published
Malicious code in @newspage/libx-amount (npm)
osv ·
npm: @newspage/libx-amount
MAL-2026-17867Published
Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)
osv ·
npm: @accenturecodefoundry/mfe-pot-shared-ui-scds-core
CVE-2026-104396Published
WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: name-directory
CVE-2026-89603Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
CVE-2026-19746Published
Calix GigaSpire traceroute.cmd denial of service
cve-program ·
Vendor product: GigaSpire
CVE-2026-19745Published
Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service
cve-program ·
Vendor product: GigaSpire
CVE-2026-111105Published
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability
cve-program ·
Vendor product: Telegram
CVE-2026-111092Published
In JetBrains YouTrack before 2026.2.19575
cve-program ·
Vendor product: YouTrack
CVE-2026-111094Published
In JetBrains TeamCity before 2026.2,
cve-program ·
Vendor product: TeamCity
CVE-2026-0320Published
PAN-OS: Authenticated Admin Command Injection Vulnerability
cve-program ·
Vendor product: Cloud NGFW · Vendor product: PAN-OS · Vendor product: Prisma Access
CVE-2026-0315Published
GlobalProtect App: Local Privilege Escalation Vulnerability on macOS
cve-program ·
Vendor product: GlobalProtect App · Vendor product: GlobalProtect App
CVE-2026-0313Published
Cortex XSOAR: OS Command Injection Vulnerability
cve-program ·
Vendor product: Cortex XSOAR OS Query · Vendor product: Cortex XSIAM OS Query
CVE-2026-97712Published
Nexus Repository 3 - Privilege Escalation via Role Management
cve-program ·
Vendor product: Nexus Repository 3
CVE-2026-101310Published
Multiple vulnerabilities in bhyve device models
cve-program ·
Vendor product: FreeBSD
CVE-2026-101309Published
Multiple vulnerabilities in bhyve device models
cve-program ·
Vendor product: FreeBSD
CVE-2026-107795Published
Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API
cve-program ·
Vendor product: Omada Software Controller
CVE-2026-101311Published
Multiple vulnerabilities in bhyve device models
cve-program ·
Vendor product: FreeBSD
CVE-2024-22031Published
Rancher users who can create Projects can gain access to arbitrary projects
cve-program ·
Vendor product: github.com/rancher/rancher
CVE-2026-110912Published
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP pack…
cve-program ·
Vendor product: DragonFlyBSD
MAL-2026-17396Published
Malicious code in kiyoramarkets (npm)
osv · GHSA-23wg-cgvp-f8w7
npm: kiyoramarkets
MAL-2026-17439Published
Malicious code in @developmentyora/baileyss (npm)
osv · GHSA-v8xh-mr86-2fpq
npm: @developmentyora/baileyss
MAL-2026-17438Published
Malicious code in @celestial-community/baileys (npm)
osv · GHSA-5ghv-64gv-gv29
npm: @celestial-community/baileys
MAL-2026-17890Published
Malicious code in @developmentyora/yorakids (npm)
osv · GHSA-xgr5-84p3-qqmf
npm: @developmentyora/yorakids
MAL-2026-17892Published
Malicious code in xmd-baileys (npm)
osv · GHSA-m3qf-j9rf-pqrh
npm: xmd-baileys
CVE-2026-110918Published
Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
cve-program ·
Vendor product: Chrome
CVE-2026-110917Published
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
cve-program ·
Vendor product: Chrome
CVE-2026-94451Published
Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache
cve-program ·
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: io.quarkus/quarkus-hibernate-orm-rest-data-panache · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: io.quarkus/quarkus-hibernate-orm-rest-data-panache · https://access.redhat.com/downloads/content/package-browser/: exploit-intelligence/agent-client-rhel9
CVE-2026-87744Published
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations
cve-program ·
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: io.quarkus/quarkus-hibernate-orm-rest-data-panache · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: io.quarkus/quarkus-hibernate-orm-rest-data-panache · https://access.redhat.com/downloads/content/package-browser/: exploit-intelligence/agent-client-rhel9
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.