CVE-2021-47899Published
YetiShare File Hosting Script 5.1.0 Remote File Upload SSRF Vulnerability
cve-program ·
Vendor product: YetiShare File Hosting Script
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698419 source statements · aliases may refer to the same vulnerabilityCVE-2019-25601Published
UltraVNC Launcher 1.2.2.4 Denial of Service Buffer Overflow
cve-program ·
Vendor product: UltraVNC Launcher
CVE-2018-25318Published
Tenda FH303/A300 V5.07.68_EN Cookie Session Weakness DNS Change
cve-program ·
Vendor product: FH303/A300
CVE-2018-25223Published
Crashmail 1.6 Stack-based Buffer Overflow Remote Code Execution
cve-program ·
Vendor product: Crashmail
CVE-2018-25135Published
Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import
cve-program ·
Vendor product: Anviz AIM CrossChex Standard
GHSA-86w9-cpqp-85rvPublished
node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements
osv · CVE-2026-33894 · CVE-2026-85393 · GHSA-ppp5-5v6c-4jwp
npm: node-forge
GHSA-ppp5-5v6c-4jwpPublished
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
osv · CVE-2026-33894 · CVE-2026-85393 · GHSA-86w9-cpqp-85rv
npm: node-forge
GHSA-g9g6-gvq9-j4vpPublished
react-dev-utils openBrowser permits command injection on macOS
osv · CVE-2026-14802
npm: react-dev-utils
CVE-2026-102370Published
Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71
cve-program ·
Vendor product: Kasa EC70 V4 · Vendor product: Kasa EC71 V4
GHSA-444v-8vxr-p36hPublished
OpenBao Agent Writes Secrets to Stdout
osv · BIT-openbao-2026-77285 · CVE-2026-77285 · GO-2026-6554
Go: github.com/openbao/openbao · Go: github.com/openbao/openbao
GO-2026-6554Published
OpenBao Agent Writes Secrets to Stdout in github.com/openbao/openbao
osv · BIT-openbao-2026-77285 · CVE-2026-77285 · GHSA-444v-8vxr-p36h
Go: github.com/openbao/openbao
GHSA-p9f8-wvj8-2fg8Published
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
osv · CVE-2026-81869 · GO-2026-6616
Go: go.opentelemetry.io/otel/sdk
GHSA-r9c8-gcjp-xfwhPublished
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
osv · CVE-2026-77410 · GO-2026-6500
Go: github.com/rabbitmq/amqp091-go
GHSA-xmfh-3ccg-c9fxPublished
Mattermost has an Incorrect Authorization issue
osv · CVE-2026-8823 · GO-2026-6547
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost/server/v8
GHSA-mvmf-94v6-879gPublished
fzf vulnerable to denial of service through quadratic HTTP request-body accumulation
osv · CVE-2026-53433 · GO-2026-6620
Go: github.com/junegunn/fzf
GHSA-w89x-c962-c44gPublished
Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope
osv · CVE-2026-77637 · GO-2026-6576
Go: github.com/cloudreve/Cloudreve/v4
GHSA-97cv-x867-6xhmPublished
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller
osv · CVE-2026-82405 · GO-2026-6582
Go: github.com/klever-io/klever-go
GHSA-27gv-rfvv-22mvPublished
RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
osv · CVE-2026-77407 · GO-2026-6491
Go: github.com/rabbitmq/amqp091-go
GHSA-328g-jx67-v94gPublished
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
osv · CVE-2026-77560 · GO-2026-6552
Go: github.com/tinyauthapp/tinyauth
GHSA-26r5-4mm2-px5cPublished
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
osv · CVE-2026-82406 · GO-2026-6584
Go: github.com/klever-io/klever-go
GHSA-456h-ww26-f758Published
Tinyauth: User enumeration attack by timing oracle
osv · CVE-2026-77582 · GO-2026-6555
Go: github.com/tinyauthapp/tinyauth
GHSA-fgmf-7rf8-m6vfPublished
ZITADEL: Actions V1 sandbox escape: host file read via require()
osv · CVE-2026-85057 · GO-2026-6591
Go: github.com/zitadel/zitadel
GHSA-9993-rfwp-rhwfPublished
ZITADEL: MFA bypass via session reuse in Login V2
osv · CVE-2026-85056 · GO-2026-6589
Go: github.com/zitadel/zitadel
GHSA-9wh6-9hq7-9688Published
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
osv · CVE-2026-82407 · GO-2026-6586
Go: github.com/klever-io/klever-go
GHSA-jpf4-98qj-qr67Published
Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass
osv · CVE-2026-76802 · GO-2026-6570
Go: github.com/projectdiscovery/nuclei/v3
GHSA-w7c2-w76w-5hmjPublished
Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
osv · BIT-cilium-2026-56742 · BIT-cilium-operator-2026-56742 · BIT-hubble-relay-2026-56742 · CVE-2026-56742
Go: github.com/cilium/cilium · Go: github.com/cilium/ciliumCilium · Go: github.com/cilium/cilium
GHSA-8h6x-h86x-75whPublished
SIPGO: DoS via unvalidated WebSocket frame length
osv · CVE-2026-77322 · GO-2026-6559
Go: github.com/emiago/sipgo
GHSA-465g-fh3v-9jw4Published
RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection
osv · CVE-2026-77404 · GO-2026-6493
Go: github.com/rabbitmq/amqp091-go
GHSA-fx76-2j3w-2mx6Published
podman quadlet install --replace does not fully replace the old file
osv · CVE-2026-19730 · GO-2026-6588
Go: github.com/containers/podman/v5
GHSA-7c7c-373r-gfjjPublished
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
osv · CVE-2026-82409 · GO-2026-6585
Go: github.com/klever-io/klever-go
GHSA-rm6m-hrcw-jw33Published
RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
osv · CVE-2026-77406 · GO-2026-6502
Go: github.com/rabbitmq/amqp091-go
GHSA-992g-9cr3-vm5xPublished
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
osv · CVE-2026-88978 · GO-2026-6560
Go: github.com/hatchet-dev/hatchet
GHSA-c5pq-fr2g-9jpfPublished
RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
osv · CVE-2026-77411 · GO-2026-6496
Go: github.com/rabbitmq/amqp091-go
GHSA-xcw9-qmmf-vqxjPublished
Dozzle label filters do not restrict container event and statistics streams
osv · CVE-2026-62286 · GO-2026-6592
Go: github.com/amir20/dozzle
GHSA-33mj-cw25-m34hPublished
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
osv · CVE-2026-77405 · GO-2026-6492
Go: github.com/rabbitmq/amqp091-go
GHSA-hjf4-fphr-2h65Published
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
osv · CVE-2026-81872 · GO-2026-6615
Go: go.opentelemetry.io/otel/sdk/log
GHSA-9q4h-f4x5-ffq8Published
Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher
osv · CVE-2026-84298 · GO-2026-6561
Go: github.com/hatchet-dev/hatchet
GHSA-gfw4-49f9-cp25Published
KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub
osv · CVE-2026-62370 · GO-2026-6569
Go: github.com/kubeedge/kubeedge · Go: github.com/kubeedge/kubeedge · Go: github.com/kubeedge/kubeedge
GHSA-9xm2-gw56-wj7mPublished
OpenShift Cluster Logging Operator missing authorization flaw
osv · CVE-2026-10609 · GO-2026-6590
Go: github.com/openshift/cluster-logging-operator
GHSA-9v8p-frvj-2pcmPublished
Klever-Go: /log controls global node logging
osv · CVE-2026-86064 · GO-2026-6583
Go: github.com/klever-io/klever-go
GHSA-5jpj-293f-rhvjPublished
KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
osv · CVE-2026-62371 · GO-2026-6557
Go: github.com/kubeedge/kubeedge · Go: github.com/kubeedge/kubeedge · Go: github.com/kubeedge/kubeedge
GHSA-34fc-gh42-pj53Published
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
osv · BIT-openbao-2026-63132 · CVE-2026-63132 · GO-2026-6553
Go: github.com/openbao/openbao · Go: github.com/openbao/openbao
GO-2026-6553Published
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao
osv · BIT-openbao-2026-63132 · CVE-2026-63132 · GHSA-34fc-gh42-pj53
Go: github.com/openbao/openbao
GHSA-g26x-m427-f48fPublished
Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check
osv · CVE-2026-63342 · GO-2026-6567
Go: github.com/hatchet-dev/hatchet
GHSA-jvh5-97xg-v99fPublished
Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses
osv · CVE-2026-79913 · GO-2026-6572
Go: github.com/cloudreve/Cloudreve/v4
GHSA-9xhm-w3wj-xhqhPublished
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service
osv · CVE-2026-77561 · GO-2026-6564
Go: github.com/steveiliop56/tinyauth
GHSA-65gg-g7rw-6cpcPublished
Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`
osv · CVE-2026-62866 · GO-2026-6548
Go: github.com/tomwright/dasel/v3
GHSA-87x6-8m9v-g8c2Published
Portainer CE allows username enumeration through authentication response timing
osv · CVE-2024-29296 · GO-2026-6619
Go: github.com/portainer/portainer
GHSA-xp3c-3jw3-4vcrPublished
OpenBao Skips Stricter Deny Policy for LIST operations
osv · BIT-openbao-2026-63131 · CVE-2026-63131 · GO-2026-6579
Go: github.com/openbao/openbao · Go: github.com/openbao/openbao
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.