CVE-2026-67226Published
RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list
cve-program ·
Vendor product: rabbitmq-server
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698811 source statements · aliases may refer to the same vulnerabilityCVE-2026-67234Published
RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
cve-program ·
Vendor product: rabbitmq-server
CVE-2026-63206Published
Zammad: Remote image tracking bypass via shortened URL scheme
cve-program ·
Vendor product: zammad
GHSA-9gfj-28hw-jchpPublished
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
osv · CVE-2026-86439
npm: knowns
GHSA-29h2-jr22-frmhPublished
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
osv ·
npm: @openzeppelin/confidential-contracts · npm: @openzeppelin/confidential-contracts · npm: @openzeppelin/confidential-contracts
CVE-2026-56726Published
Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak
cve-program ·
Vendor product: zammad
CVE-2026-56731Published
Zammad: Cross-Site Scripting in Ticket Notifications
cve-program ·
Vendor product: zammad
CVE-2026-45801Published
GLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)
cve-program ·
Vendor product: glpi
CVE-2026-71543Published
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
cve-program ·
Vendor product: openbao
CVE-2026-68919Published
GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages
cve-program ·
Vendor product: gocd
CVE-2026-52743Published
GoCD before 26.1.0 is vulnerable to authorization bypass via job status API
cve-program ·
Vendor product: gocd
CVE-2026-54584Published
mport trusts environment-controlled temporary directories in privileged metadata extraction
cve-program ·
Vendor product: mport
CVE-2026-71855Published
Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state
cve-program ·
Vendor product: suricata
CVE-2026-57229Published
Suricata smtp/mime: incomplete state reset allows detection bypass
cve-program ·
Vendor product: suricata
CVE-2026-67408Published
RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
cve-program ·
Vendor product: rabbitmq-server
CVE-2026-100305Published
TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint
cve-program ·
https://github.com/TDuckCloud/tduck-survey-form: tduck-survey-form
CVE-2026-56735Published
Zammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad
cve-program ·
Vendor product: zammad
CVE-2026-53625Published
GLPI: Privilege Escalation via authtype API manipulation
cve-program ·
Vendor product: glpi
CVE-2026-84458Published
Zammad: Account takeover via unverified email matching during SSO auto-link
cve-program ·
Vendor product: zammad
CVE-2026-55217Published
GLPI: Unallowed modfication of knowbase items comments and translations
cve-program ·
Vendor product: glpi
CVE-2026-84464Published
Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data
cve-program ·
Vendor product: zammad
CVE-2026-53627Published
GLPI: Unexpected access to update operations through the API
cve-program ·
Vendor product: glpi
CVE-2026-61855Published
Zammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail
cve-program ·
Vendor product: zammad
MAL-2026-17186Published
Malicious code in @nubjs/types (npm)
osv · GHSA-7qx8-98q7-66p4
npm: @nubjs/types
CVE-2026-63208Published
Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
cve-program ·
Vendor product: zammad
CVE-2026-63204Published
Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets
cve-program ·
Vendor product: zammad
CVE-2026-84461Published
Zammad: Missing rate limiting allows password brute-forcing during two-factor login
cve-program ·
Vendor product: zammad
CVE-2026-97895Published
krayin laravel-crm User Management UserController.php privileges management
cve-program ·
Vendor product: laravel-crm
CVE-2026-97063Published
X-SpringBoot through 6.0 Authentication Bypass via Login Code
cve-program ·
Vendor product: X-SpringBoot
CVE-2026-97884Published
mathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection
cve-program ·
Vendor product: CloudClassroom-PHP-Project
CVE-2026-65828Published
Zammad: Pending upload deletion bypass via legacy attachment endpoint
cve-program ·
Vendor product: zammad
CVE-2026-56728Published
Zammad: Cross-User Taskbar Item Access Control Vulnerability
cve-program ·
Vendor product: zammad
CVE-2026-56733Published
Zammad: Incorrect Authorization and Improper Privilege Management
cve-program ·
Vendor product: zammad
CVE-2026-91838Published
Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields
cve-program ·
https://gitlab.gnome.org/GNOME/network-manager-sstp: network-manager-sstp
CVE-2026-84462Published
Zammad: AI Agent template sanitizer bypass leads to remote code execution
cve-program ·
Vendor product: zammad
CVE-2026-97885Published
mathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection
cve-program ·
Vendor product: CloudClassroom-PHP-Project
CVE-2026-88361Published
SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.
cve-program ·
Vendor product: n/a
CVE-2026-90901Published
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0
cve-program ·
Vendor product: Easy Store extension for Joomla
CVE-2026-88369Published
zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().
cve-program ·
Vendor product: n/a
GHSA-2v4p-qf9q-27wjPublished
gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers
osv · CVE-2026-84445 · GO-2026-6443
Go: google.golang.org/grpc · Go: google.golang.org/grpc · Go: google.golang.org/grpc
RUSTSEC-2026-0310Published
Various panics, soundness and resource exhaustion issues
osv ·
crates.io: domain
RUSTSEC-2026-0309Published
`SinglyLinkedList::remove` dereferences a null link
osv ·
crates.io: bun_collections
CVE-2026-90902Published
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0
cve-program ·
Vendor product: Easy Store extension for Joomla
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.