CVE-2026-100579Published
OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester
cve-program ·
Vendor product: OpenClaw
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698779 source statements · aliases may refer to the same vulnerabilityCVE-2026-100587Published
OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
cve-program ·
Vendor product: OpenClaw
CVE-2026-100591Published
OpenClaw before 2026.7.1 Authentication Bypass via Active Memory
cve-program ·
Vendor product: OpenClaw
CVE-2026-100595Published
OpenClaw before 2026.7.1 Authorization Bypass via diagnostics
cve-program ·
Vendor product: OpenClaw
CVE-2026-48100Published
Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages
cve-program ·
Vendor product: payy
CVE-2026-54160Published
Network UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with write-scoped GITHUB_TOKEN
cve-program ·
Vendor product: nut
CVE-2026-77262Published
MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)
cve-program ·
Vendor product: mcp-atlassian
CVE-2026-77267Published
mcp-atlassian has an incomplete SSRF remediation
cve-program ·
Vendor product: mcp-atlassian
CVE-2026-56744Published
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)
cve-program ·
Vendor product: @bsv/wallet-toolbox · Vendor product: @bsv/wallet-toolbox-client · Vendor product: @bsv/wallet-toolbox-mobile
CVE-2026-101083Published
PMWeb encryptionhelper.dll information disclosure
cve-program ·
Vendor product: PMWeb
CVE-2026-100615Published
Cap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation
cve-program ·
Vendor product: capgo.app
GHSA-jhjp-4c2q-xmx4Published
k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers
osv · GO-2026-6538
Go: github.com/falcosecurity/plugins/plugins/k8saudit · Go: github.com/falcosecurity/plugins/plugins/k8saudit-eks · Go: github.com/falcosecurity/plugins/plugins/k8saudit-gke
GHSA-h998-hxxj-8q83Published
Mattermost doesn't invalidate cached authentication state for active WebSocket connections during global session revocation
osv · CVE-2026-9162 · GO-2026-6482
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server
GHSA-9g84-39mm-q4p3Published
Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
osv · BIT-grafana-2026-9029 · CVE-2026-9029 · GO-2026-6542
Go: github.com/grafana/grafana · Go: github.com/grafana/grafana · Go: github.com/grafana/grafana
GO-2026-6542Published
Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana
osv · BIT-grafana-2026-9029 · CVE-2026-9029 · GHSA-9g84-39mm-q4p3
Go: github.com/grafana/grafana · Go: github.com/grafana/grafana · Go: github.com/grafana/grafana
GHSA-9468-v6mj-fppwPublished
Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
osv · CVE-2026-71485 · GO-2026-6490
Go: github.com/centrifugal/centrifugo
GHSA-gxjc-74v5-3vx3Published
Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic
osv · CVE-2026-61794 · GO-2026-6521
Go: github.com/projectcapsule/capsule
GHSA-f94q-w3w8-cj67Published
Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
osv · CVE-2026-61795 · GO-2026-6519
Go: github.com/projectcapsule/capsule
GHSA-hf33-q6cf-c66fPublished
nginx ignition has TOTP Reuse During Validity Window
osv · CVE-2026-61630 · GO-2026-6537
Go: github.com/lucasdillmann/nginx-ignition
GHSA-rf68-8gjr-36q7Published
Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty
osv · CVE-2026-101090 · GO-2026-6486
Go: github.com/nezhahq/nezha
GO-2026-6486Published
Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty in github.com/nezhahq/nezha
osv · CVE-2026-101090 · GHSA-rf68-8gjr-36q7
Go: github.com/nezhahq/nezha
GHSA-4227-9989-jrhxPublished
Perses's missing authorization in datasource proxy allows cross-scope secret disclosure
osv · CVE-2026-63199 · GO-2026-6514
Go: github.com/perses/perses
GHSA-5gpm-rgj3-9q76Published
Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)
osv · CVE-2026-86043 · GO-2026-6495
Go: github.com/zalando/skipper
GHSA-g3pg-frfm-pr2mPublished
OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user
osv · CVE-2026-61709 · GO-2026-6488
Go: github.com/openfga/openfga
GHSA-w72w-9qmj-c9qmPublished
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
osv · CVE-2026-63406 · GO-2026-6529
Go: github.com/anycable/anycable
GHSA-jqgv-39mg-7c2rPublished
Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret
osv · CVE-2026-6673 · GO-2026-6483
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server
GHSA-c8w2-fgvx-vhv4Published
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace
osv · CVE-2026-61682 · GO-2026-6517
Go: github.com/kcp-dev/kcp · Go: github.com/kcp-dev/kcp
GHSA-5gm3-9crp-6g3vPublished
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
osv · CVE-2026-77339 · GO-2026-6515
Go: github.com/f1bonacc1/process-compose
GHSA-jr34-h97m-9hpxPublished
nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware
osv · CVE-2026-61629 · GO-2026-6539
Go: github.com/lucasdillmann/nginx-ignition
GHSA-r8cr-4f9w-7r75Published
Netmaker has a boolean‑based SQL Injection
osv · CVE-2026-32599 · GO-2026-6485
Go: github.com/gravitl/netmaker
GHSA-9493-h4f5-633xPublished
Grafana: Path traversal in the Tempo and Loki data source plugins
osv · BIT-grafana-2026-10601 · CVE-2026-10601 · GO-2026-6545
Go: github.com/grafana/grafana · Go: github.com/grafana/grafana · Go: github.com/grafana/grafana
GO-2026-6545Published
Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana
osv · BIT-grafana-2026-10601 · CVE-2026-10601 · GHSA-9493-h4f5-633x
Go: github.com/grafana/grafana · Go: github.com/grafana/grafana · Go: github.com/grafana/grafana
GHSA-mrg3-qvqr-jw29Published
CoreDNS: Unauthenticated memory exhaustion in custom transports
osv · CVE-2026-82399 · GO-2026-6507
Go: github.com/coredns/coredns
GHSA-crm4-q7v4-c2r2Published
Canonical ADSys Uses a Less Trusted Source
osv · CVE-2026-12249 · GO-2026-6543
Go: github.com/ubuntu/adsys
GHSA-pxcx-fv34-x9p5Published
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
osv · CVE-2026-61628 · GO-2026-6540
Go: github.com/lucasdillmann/nginx-ignition
GHSA-2g8v-grq3-hq2gPublished
Mattermost doesn't enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler
osv · CVE-2026-5139 · GO-2026-6480
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server
GHSA-cjgj-2fwf-4c2wPublished
Perses's project query parameter authorization bypass exposes cross-project resources
osv · CVE-2026-63458 · GO-2026-6518
Go: github.com/perses/perses
GHSA-5p54-whvp-x327Published
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body
osv · CVE-2026-63405 · GO-2026-6516
Go: github.com/anycable/anycable
GHSA-p5vg-v7mj-f6q4Published
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
osv · CVE-2026-81505 · GO-2026-6523
Go: github.com/frain-dev/convoy
GHSA-mxq2-5jpg-7474Published
Mattermost doesn't validate channel ownership of an existing subscription before applying edits
osv · CVE-2026-6062 · GO-2026-6484
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server
GHSA-qg67-7m6v-qg25Published
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
osv · CVE-2026-61833 · GO-2026-6527
Go: zotregistry.dev/zot/v2
GHSA-3w66-95m3-8jxgPublished
Grafana: Pre-authentication denial of service in the public dashboard query handler
osv · BIT-grafana-2026-42127 · CVE-2026-42127 · GO-2026-6541
Go: github.com/grafana/grafana · Go: github.com/grafana/grafana · Go: github.com/grafana/grafana
GO-2026-6541Published
Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana
osv · BIT-grafana-2026-42127 · CVE-2026-42127 · GHSA-3w66-95m3-8jxg
Go: github.com/grafana/grafana · Go: github.com/grafana/grafana · Go: github.com/grafana/grafana
GHSA-w34q-cm8f-9c5xPublished
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
osv · CVE-2026-81871 · GO-2026-6508
Go: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
GHSA-f74p-cwhp-x2wxPublished
Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability.
osv · CVE-2026-42129 · GO-2026-6544
Go: github.com/grafana/grafana · Go: github.com/grafana/grafana · Go: github.com/grafana/grafana
GHSA-4595-rvpx-4q34Published
emp3r0r has an unauthenticated HTTP Polling DoS
osv · CVE-2026-61554 · GO-2026-6487
Go: github.com/jm33-m0/emp3r0r/core
GHSA-pr6h-vr44-xq8jPublished
Obot: MCP Registry API readable without authentication
osv · CVE-2026-101063 · GO-2026-6525
Go: github.com/obot-platform/obot
GO-2026-6525Published
Obot: MCP Registry API readable without authentication in github.com/obot-platform/obot
osv · CVE-2026-101063 · GHSA-pr6h-vr44-xq8j
Go: github.com/obot-platform/obot
GHSA-g5vr-6pgg-74qvPublished
Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint
osv · CVE-2026-8074 · GO-2026-6481
Go: github.com/mattermost/mattermost-server · Go: github.com/mattermost/mattermost-server
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.