GO-2026-6579Published
OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao
osv · BIT-openbao-2026-63131 · CVE-2026-63131 · GHSA-xp3c-3jw3-4vcr
Go: github.com/openbao/openbao
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698419 source statements · aliases may refer to the same vulnerabilityGHSA-4v58-74mf-rjx3Published
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
osv · CVE-2026-77412 · GO-2026-6494
Go: github.com/rabbitmq/amqp091-go
GHSA-cqxr-jxr2-85pqPublished
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
osv · CVE-2026-59168 · GO-2026-6549
Go: github.com/tomwright/dasel/v3
GHSA-j497-x9hr-x34xPublished
RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow
osv · CVE-2026-77408 · GO-2026-6498
Go: github.com/rabbitmq/amqp091-go
GHSA-9vm9-pqxx-x83vPublished
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
osv · CVE-2026-62369 · GO-2026-6563
Go: github.com/kubeedge/kubeedge · Go: github.com/kubeedge/kubeedge · Go: github.com/kubeedge/kubeedge
GHSA-8wmf-6v46-5gfgPublished
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
osv · CVE-2026-81870 · GO-2026-6505
Go: go.opentelemetry.io/otel/sdk · Go: go.opentelemetry.io/otel/exporters/otlp/otlptrace · Go: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
GHSA-h7vf-4x9w-h99vPublished
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
osv · CVE-2026-85732 · GO-2026-6497
Go: oras.land/oras-go/v2
GHSA-4hq8-gpf5-8p68Published
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
osv · CVE-2026-57231 · GO-2026-6594
Go: github.com/containers/podman/v5 · Go: go.podman.io/podman/v6 · Go: github.com/containers/podman/v4
GHSA-jpvm-9frm-hjcqPublished
Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode
osv · CVE-2026-76805 · GO-2026-6571
Go: github.com/projectdiscovery/nuclei/v3
GHSA-m37j-52j7-pjw7Published
oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)
osv · CVE-2026-85731 · GO-2026-6499
Go: oras.land/oras-go/v2
GHSA-59w7-v8rr-pr4pPublished
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
osv · BIT-openbao-2026-71543 · CVE-2026-71543 · GO-2026-6556
Go: github.com/openbao/openbao · Go: github.com/openbao/openbao
GO-2026-6556Published
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters in github.com/openbao/openbao
osv · BIT-openbao-2026-71543 · CVE-2026-71543 · GHSA-59w7-v8rr-pr4p
Go: github.com/openbao/openbao
GO-2026-6512Published
Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy
osv · CVE-2026-77281 · CVE-2026-92284 · CVE-2026-92700 · GHSA-j8px-rmrx-76h9
Go: github.com/caddyserver/caddy/v2
GHSA-pg59-5vwg-4jxqPublished
SIPGO: DoS via unvalidated Content-Length in the stream parser
osv · CVE-2026-58268 · GO-2026-6550
Go: github.com/emiago/sipgo
GHSA-qgw5-7j4f-fg97Published
Nuclei: Local File Read via Workflow File-Protocol Gate Bypass
osv · CVE-2026-76804 · GO-2026-6574
Go: github.com/projectdiscovery/nuclei/v3
GHSA-4fwh-wrm6-97xmPublished
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
osv · CVE-2026-86065 · GO-2026-6581
Go: github.com/klever-io/klever-go
GHSA-pg57-6jwg-q645Published
Containerd has image-pull DoS via crafted OCI index graph amplification
osv · CVE-2026-53493 · GO-2026-6597
Go: github.com/containerd/containerd/v2 · Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
GHSA-vxg7-f2jj-jmqmPublished
Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability
osv · CVE-2026-76819 · GO-2026-6575
Go: github.com/projectdiscovery/nuclei/v3
GHSA-w3rp-4cm2-4wgcPublished
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
osv · CVE-2026-61604 · GO-2026-6595
Go: github.com/ixofoundation/ixo-blockchain/v8 · Go: github.com/ixofoundation/ixo-blockchain/v7 · Go: github.com/ixofoundation/ixo-blockchain/v6
GHSA-xj3h-wwxq-gfcjPublished
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service
osv · CVE-2026-77633 · GO-2026-6578
Go: github.com/cloudreve/Cloudreve/v4
GHSA-fq95-v8xc-jm3vPublished
Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header
osv · CVE-2026-62987 · GO-2026-6566
Go: github.com/fabiolb/fabio
GHSA-xhmx-w2j4-rw3qPublished
Nuclei: Local File Read via MySQL Client Sandbox Bypass
osv · CVE-2026-76803 · GO-2026-6577
Go: github.com/projectdiscovery/nuclei/v3
GHSA-xwwf-m8fg-p9q2Published
RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation
osv · CVE-2026-77403 · GO-2026-6503
Go: github.com/rabbitmq/amqp091-go
GHSA-m3c6-2p7h-cfr3Published
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
osv · CVE-2026-62182 · GO-2026-6573
Go: github.com/kubeedge/kubeedge · Go: github.com/kubeedge/kubeedge · Go: github.com/kubeedge/kubeedge
GO-2026-6616Published
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation in go.opentelemetry.io/otel/sdk
osv · CVE-2026-81869 · GHSA-p9f8-wvj8-2fg8
Go: go.opentelemetry.io/otel/sdk
GO-2026-6597Published
Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd
osv · CVE-2026-53493 · GHSA-pg57-6jwg-q645
Go: github.com/containerd/containerd · Go: github.com/containerd/containerd/v2
GO-2026-6577Published
Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei
osv · CVE-2026-76803 · GHSA-xhmx-w2j4-rw3q
Go: github.com/projectdiscovery/nuclei · Go: github.com/projectdiscovery/nuclei/v2 · Go: github.com/projectdiscovery/nuclei/v3
GO-2026-6590Published
OpenShift Cluster Logging Operator missing authorization flaw in github.com/openshift/cluster-logging-operator
osv · CVE-2026-10609 · GHSA-9xm2-gw56-wj7m
Go: github.com/openshift/cluster-logging-operator
GO-2026-6589Published
ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel
osv · CVE-2026-85056 · GHSA-9993-rfwp-rhwf
Go: github.com/zitadel/zitadel
GO-2026-6569Published
KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub in github.com/kubeedge/kubeedge
osv · CVE-2026-62370 · GHSA-gfw4-49f9-cp25
Go: github.com/kubeedge/kubeedge
GO-2026-6574Published
Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei
osv · CVE-2026-76804 · GHSA-qgw5-7j4f-fg97
Go: github.com/projectdiscovery/nuclei · Go: github.com/projectdiscovery/nuclei/v2 · Go: github.com/projectdiscovery/nuclei/v3
GO-2026-6594Published
Podman: Malformed Image can trick podman run into leaking host environment variables into the container in github.com/containers/libpod
osv · CVE-2026-57231 · GHSA-4hq8-gpf5-8p68
Go: github.com/containers/libpod · Go: github.com/containers/podman · Go: github.com/containers/podman/v2
GO-2026-6620Published
fzf vulnerable to denial of service through quadratic HTTP request-body accumulation in github.com/junegunn/fzf
osv · CVE-2026-53433 · GHSA-mvmf-94v6-879g
Go: github.com/junegunn/fzf
GO-2026-6578Published
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service in github.com/cloudreve/Cloudreve
osv · CVE-2026-77633 · GHSA-xj3h-wwxq-gfcj
Go: github.com/cloudreve/Cloudreve · Go: github.com/cloudreve/Cloudreve/v3 · Go: github.com/cloudreve/Cloudreve/v4
GO-2026-6595Published
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass in github.com/ixofoundation/ixo-blockchain
osv · CVE-2026-61604 · GHSA-w3rp-4cm2-4wgc
Go: github.com/ixofoundation/ixo-blockchain · Go: github.com/ixofoundation/ixo-blockchain/v3 · Go: github.com/ixofoundation/ixo-blockchain/v4
GO-2026-6586Published
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS in github.com/klever-io/klever-go
osv · CVE-2026-82407 · GHSA-9wh6-9hq7-9688
Go: github.com/klever-io/klever-go
GO-2026-6581Published
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) in github.com/klever-io/klever-go
osv · CVE-2026-86065 · GHSA-4fwh-wrm6-97xm
Go: github.com/klever-io/klever-go
GO-2026-6585Published
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go
osv · CVE-2026-82409 · GHSA-7c7c-373r-gfjj
Go: github.com/klever-io/klever-go
GO-2026-6591Published
ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel
osv · CVE-2026-85057 · GHSA-fgmf-7rf8-m6vf
Go: github.com/zitadel/zitadel
GO-2026-6584Published
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go
osv · CVE-2026-82406 · GHSA-26r5-4mm2-px5c
Go: github.com/klever-io/klever-go
GO-2026-6619Published
Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer
osv · CVE-2024-29296 · GHSA-87x6-8m9v-g8c2
Go: github.com/portainer/portainer
GO-2026-6592Published
Dozzle label filters do not restrict container event and statistics streams in github.com/amir20/dozzle
osv · CVE-2026-62286 · GHSA-xcw9-qmmf-vqxj
Go: github.com/amir20/dozzle
GO-2026-6588Published
podman quadlet install --replace does not fully replace the old file in github.com/containers/podman
osv · CVE-2026-19730 · GHSA-fx76-2j3w-2mx6
Go: github.com/containers/podman · Go: github.com/containers/podman/v2 · Go: github.com/containers/podman/v3
GO-2026-6583Published
Klever-Go: /log controls global node logging in github.com/klever-io/klever-go
osv · CVE-2026-86064 · GHSA-9v8p-frvj-2pcm
Go: github.com/klever-io/klever-go
GO-2026-6615Published
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log
osv · CVE-2026-81872 · GHSA-hjf4-fphr-2h65
Go: go.opentelemetry.io/otel/sdk/log
GO-2026-6570Published
Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei
osv · CVE-2026-76802 · GHSA-jpf4-98qj-qr67
Go: github.com/projectdiscovery/nuclei · Go: github.com/projectdiscovery/nuclei/v2 · Go: github.com/projectdiscovery/nuclei/v3
GO-2026-6560Published
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet
osv · CVE-2026-88978 · GHSA-992g-9cr3-vm5x
Go: github.com/hatchet-dev/hatchet
GO-2026-6571Published
Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode in github.com/projectdiscovery/nuclei
osv · CVE-2026-76805 · GHSA-jpvm-9frm-hjcq
Go: github.com/projectdiscovery/nuclei · Go: github.com/projectdiscovery/nuclei/v2 · Go: github.com/projectdiscovery/nuclei/v3
GO-2026-6573Published
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes in github.com/kubeedge/kubeedge
osv · CVE-2026-62182 · GHSA-m3c6-2p7h-cfr3
Go: github.com/kubeedge/kubeedge
GO-2026-6575Published
Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability in github.com/projectdiscovery/nuclei
osv · CVE-2026-76819 · GHSA-vxg7-f2jj-jmqm
Go: github.com/projectdiscovery/nuclei · Go: github.com/projectdiscovery/nuclei/v2 · Go: github.com/projectdiscovery/nuclei/v3
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.