GO-2026-4513Published
Denial of service in github.com/shamaton/msgpack
osv · CVE-2026-32284 · GHSA-h9q6-hc68-35rp
Go: github.com/shamaton/msgpack · Go: github.com/shamaton/msgpack/v2 · Go: github.com/shamaton/msgpack/v3
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698132 source statements · aliases may refer to the same vulnerabilityGHSA-j4ph-9xwf-wcj4Published
SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
osv · CVE-2026-73609 · GO-2026-6634
Go: github.com/siyuan-note/siyuan/kernel
GHSA-4wwp-f6gw-6qm5Published
SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)
osv · CVE-2026-85175 · GO-2026-6663
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6663Published
SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-85175 · GHSA-4wwp-f6gw-6qm5
Go: github.com/siyuan-note/siyuan/kernel
GHSA-8c5q-hx4g-qq23Published
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs
osv · CVE-2026-59707 · GO-2026-6645
Go: github.com/mudler/LocalAI
GHSA-53fp-9jmv-227gPublished
SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check
osv · CVE-2026-73607 · GO-2026-6624
Go: github.com/siyuan-note/siyuan/kernel
GHSA-84vh-m24q-wjjxPublished
Pocketbase: Unhandled panic in worker goroutines
osv · CVE-2026-82410 · GO-2026-6489
Go: github.com/pocketbase/pocketbase · Go: github.com/pocketbase/pocketbase
GHSA-hgfg-j9pg-43xwPublished
SiYuan discloses an administrator's open documents and search terms to anonymous readers
osv · CVE-2026-72788 · GO-2026-6622
Go: github.com/siyuan-note/siyuan/kernel
GHSA-x8gv-g2g3-65fjPublished
SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)
osv · CVE-2026-82234 · GO-2026-6657
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6657Published
SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-82234 · GHSA-x8gv-g2g3-65fj
Go: github.com/siyuan-note/siyuan/kernel
GHSA-p5x9-j974-rpfpPublished
Grafana legacy correlations allow cross-tenant disclosure and deletion
osv · BIT-grafana-2026-21727 · CVE-2026-21727 · GO-2026-6664
Go: github.com/grafana/grafana
GO-2026-6664Published
Grafana legacy correlations allow cross-tenant disclosure and deletion in github.com/grafana/grafana
osv · BIT-grafana-2026-21727 · CVE-2026-21727 · GHSA-p5x9-j974-rpfp
Go: github.com/grafana/grafana
GHSA-x4q3-gcj3-m6cfPublished
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
osv · CVE-2026-73802 · GO-2026-6656
Go: gitea.com/gitea/runner
GHSA-vg99-7gj7-2fr5Published
SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block
osv · CVE-2026-73606 · GO-2026-6635
Go: github.com/siyuan-note/siyuan/kernel
GHSA-3cc2-h3v6-rqpqPublished
SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
osv · CVE-2026-74802 · GO-2026-6650
Go: github.com/siyuan-note/siyuan/kernel
GHSA-27c6-wp53-387xPublished
Nightingale exposes datasource credentials to low-privilege users
osv · CVE-2026-58167 · GO-2026-6638
Go: github.com/ccfos/nightingale/v6
GHSA-33jq-p8c2-q3q4Published
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
osv · CVE-2026-69085 · GO-2026-6621
Go: github.com/siyuan-note/siyuan/kernel
GHSA-6wcg-mqvh-fcvgPublished
Anubis: Policy bypass via client controlled X-Original-URI header
osv · CVE-2026-62314 · GO-2026-6639
Go: github.com/TecharoHQ/anubis
GHSA-3cm4-ccvw-6xr6Published
SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*
osv · CVE-2026-82651 · GO-2026-6662
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6662Published
SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-82651 · GHSA-3cm4-ccvw-6xr6
Go: github.com/siyuan-note/siyuan/kernel
GHSA-hf8h-97gm-4x2pPublished
SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem
osv · CVE-2026-73605 · GO-2026-6626
Go: github.com/siyuan-note/siyuan/kernel
CVE-2025-40551Published
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
cve-program ·
Vendor product: Web Help Desk
CVE-2025-3928Published
Commvault Web Server unspecified vulnerability
cve-program ·
Vendor product: Web Server
CVE-2021-0158Published
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) Processors
CVE-2021-0157Published
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
cve-program ·
Vendor product: Intel(R) Processors
CVE-2026-92393Published
Apache YuniKorn: Admission control bypass via workload UPDATE operation
cve-program ·
https://golang.org/pkg: github.com/apache/yunikorn-k8shim
CVE-2026-106491Published
Backstage: Improper input validation in proxy-backend
cve-program ·
Vendor product: backstage · Vendor product: plugin-proxy-backend
CVE-2022-0235Published
Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch
cve-program ·
Vendor product: node-fetch/node-fetch
CVE-2026-78243Published
Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
cve-program ·
https://golang.org/pkg: github.com/apache/yunikorn-k8shim
CVE-2026-95606Published
WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: the-events-calendar
CVE-2026-94662Published
WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: unlimited-elements-for-elementor
CVE-2024-30040Published
Windows MSHTML Platform Security Feature Bypass Vulnerability
cve-program ·
Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows Server 2019
CVE-2026-96408Published
A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
cve-program ·
Vendor product: Movable Type Cloud Edition · Vendor product: Movable Type · Vendor product: Movable Type Premium Cloud Edition
CVE-2026-106557Published
Backstage: Improper input validation in TechDocs Markdown extension configuration
cve-program ·
Vendor product: backstage · Vendor product: plugin-techdocs-node
CVE-2026-32284Published
Denial of service in github.com/shamaton/msgpack
cve-program ·
https://pkg.go.dev: github.com/shamaton/msgpack · https://pkg.go.dev: github.com/shamaton/msgpack/v2 · https://pkg.go.dev: github.com/shamaton/msgpack/v3
CVE-2026-106499Published
Backstage: Secret-derived values may be exposed in scaffolder task logs
cve-program ·
Vendor product: backstage · Vendor product: plugin-scaffolder-backend
CVE-2026-103668Published
An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.
cve-program ·
Vendor product: Movable Type Cloud Edition · Vendor product: Movable Type · Vendor product: Movable Type Premium Cloud Edition
CVE-2026-92532Published
Unrestricted Upload of File with Dangerous Type in BugTracker.NET
cve-program ·
Vendor product: BugTracker.NET
GO-2026-6635Published
SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-73606 · GHSA-vg99-7gj7-2fr5
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6638Published
Nightingale exposes datasource credentials to low-privilege users in github.com/ccfos/nightingale
osv · CVE-2026-58167 · GHSA-27c6-wp53-387x
Go: github.com/ccfos/nightingale · Go: github.com/ccfos/nightingale/v4 · Go: github.com/ccfos/nightingale/v5
GO-2026-6621Published
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-69085 · GHSA-33jq-p8c2-q3q4
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6622Published
SiYuan discloses an administrator's open documents and search terms to anonymous readers in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-72788 · GHSA-hgfg-j9pg-43xw
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6596Published
Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium
osv · BIT-cilium-2026-56742 · BIT-cilium-operator-2026-56742 · BIT-hubble-relay-2026-56742 · CVE-2026-56742
Go: github.com/cilium/cilium
GO-2026-6650Published
SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-74802 · GHSA-3cc2-h3v6-rqpq
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6645Published
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs in github.com/mudler/LocalAI
osv · CVE-2026-59707 · GHSA-8c5q-hx4g-qq23
Go: github.com/mudler/LocalAI
GO-2026-6626Published
SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-73605 · GHSA-hf8h-97gm-4x2p
Go: github.com/siyuan-note/siyuan/kernel
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.