GHSA-fx6f-382r-j72cPublished
CyberChef: Prototype pollution in Series Chart operation
osv · CVE-2026-57439
npm: cyberchef
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698828 source statements · aliases may refer to the same vulnerabilityGHSA-fm8p-53ww-hf6wPublished
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
osv · CVE-2026-61742
npm: @bytebase/dbhub
CVE-2026-82566Published
Botslab G980H Dashcams Insufficient session expiration
cve-program ·
Vendor product: G980H
CVE-2026-84399Published
Botslab G980H Dashcams Incorrect Authorization
cve-program ·
Vendor product: G980H
CVE-2026-48540Published
Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title
cve-program ·
Vendor product: laravel-crm
GHSA-6v3r-4p5c-mrp5Published
Language Servers for AWS vulnerable to arbitrary file write
osv · CVE-2026-12958
npm: @aws/lsp-codewhisperer
GHSA-xhcr-j4j9-3gh7Published
Language Servers for AWS Vulnerable to Arbitrary Code Execution
osv · CVE-2026-12957
npm: @aws/lsp-codewhisperer
CVE-2026-89090Published
Denial of service in the event stream header decoder in AWS SDK for Go v2
cve-program ·
Vendor product: AWS SDK for Go v2
CVE-2026-96883Published
Type confusion in AWS pgcollection allows remote code execution
cve-program ·
Vendor product: pgcollection
CVE-2026-97323Published
YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal
cve-program ·
Vendor product: ruoyi-vue-pro · Vendor product: ruoyi-vue-pro
CVE-2026-48073Published
Docmost: Page export can include restricted same-space attachments through forged attachmentId
cve-program ·
Vendor product: docmost
CVE-2026-65827Published
Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service
cve-program ·
Vendor product: docmost
CVE-2026-13248Published
Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface
cve-program ·
Vendor product: PD45 Industrial Printer
CVE-2026-86858Published
Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform
cve-program ·
Vendor product: ServiceNow AI Platform
CVE-2026-86859Published
Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform
cve-program ·
Vendor product: ServiceNow AI Platform
GHSA-2jx3-ff3v-j7jjPublished
yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
osv ·
crates.io: yara-x
CVE-2026-96748Published
Connection redirection via percent-encoded delimiter injection in connection string hosts
cve-program ·
Vendor product: Python Driver
CVE-2026-96747Published
Forced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption
cve-program ·
Vendor product: Python Driver
CVE-2026-80156Published
Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass
cve-program ·
Vendor product: SLC8000 · Vendor product: EMG8500 · Vendor product: EMG7500
CVE-2026-80155Published
Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
cve-program ·
Vendor product: SLC8000 · Vendor product: EMG8500 · Vendor product: EMG7500
CVE-2026-80154Published
Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
cve-program ·
Vendor product: SLC8000 · Vendor product: EMG8500 · Vendor product: EMG7500
CVE-2026-80147Published
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
cve-program ·
Vendor product: SLC8000 · Vendor product: EMG8500 · Vendor product: EMG7500
CVE-2026-80143Published
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read
cve-program ·
Vendor product: SLC8000 · Vendor product: EMG8500 · Vendor product: EMG7500
CVE-2026-80144Published
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write
cve-program ·
Vendor product: SLC8000 · Vendor product: EMG8500 · Vendor product: EMG7500
CVE-2026-80145Published
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password
cve-program ·
Vendor product: SLC8000 · Vendor product: EMG8500 · Vendor product: EMG7500
CVE-2026-81455Published
Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to …
cve-program ·
Vendor product: ThinOS 10
CVE-2026-61825Published
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
cve-program ·
Vendor product: sharp
CVE-2026-97321Published
YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection
cve-program ·
Vendor product: ruoyi-vue-pro · Vendor product: ruoyi-vue-pro
CVE-2026-48072Published
Docmost: Public image fileName path traversal leads to unauthorized local file read
cve-program ·
Vendor product: docmost
CVE-2026-77293Published
TREK: Cross-user note-file deletion (IDOR / Broken Access Control)
cve-program ·
Vendor product: TREK
GHSA-5p2g-fcmc-qvqqPublished
image-size: JXL and HEIF parsers allow denial of service through infinite loops
osv · CVE-2025-71329
npm: image-size
GHSA-26pp-8wgv-hjvmPublished
Hono missing validation of cookie name on write path in setCookie()
osv · CVE-2026-56762
npm: hono
CVE-2026-13249Published
Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040
cve-program ·
Vendor product: PD45 Industrial Printer
CVE-2026-77294Published
TREK: Server-Side Request Forgery via User-Configurable LLM Base URL
cve-program ·
Vendor product: TREK
GHSA-w3rx-r6r6-pgprPublished
image-size: ICNS parser allows denial of service through an infinite loop
osv · CVE-2025-71330
npm: image-size
CVE-2026-34689Published
Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
cve-program ·
Vendor product: Adobe Connect · Vendor product: Adobe Connect Android Mobile App
CVE-2026-75743Published
Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352)
cve-program ·
Vendor product: AEM 6.5 Forms JEE · Vendor product: AEM 6.5 LTS Forms JEE
CVE-2026-96745Published
PHP object injection via unsuppressible __pclass class inference in command monitoring events
cve-program ·
Vendor product: PHP Driver
CVE-2026-96746Published
Heap buffer overflow via mid-scan command list growth in client topology monitoring
cve-program ·
Vendor product: C Driver
CVE-2026-61816Published
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
cve-program ·
Vendor product: mail-mime-parser
CVE-2026-57179Published
social-auth-core has a Session Fixation issue
cve-program ·
Vendor product: social-core
CVE-2026-88382Published
hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.
cve-program ·
Vendor product: n/a
CVE-2026-81508Published
ESF-IDF: Heap Out-of-Bounds Read in Bluedroid A2DP Sink Media Packet Processing
cve-program ·
Vendor product: esp-idf
CVE-2026-61604Published
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass
cve-program ·
Vendor product: ixo-blockchain
CVE-2026-61784Published
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
cve-program ·
Vendor product: node-xhtml-purifier
CVE-2026-61811Published
Wazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion
cve-program ·
Vendor product: wazuh
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.