CVE-2026-17503Published
This Power System update is being released to address
cve-program ·
Vendor product: PowerVM Hypervisor
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698828 source statements · aliases may refer to the same vulnerabilityCVE-2026-18870Published
This Power System update is being released to address
cve-program ·
Vendor product: PowerVM Hypervisor
CVE-2026-81539Published
DataStage on Cloud Pak for Data has several vulnerabilities
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
CVE-2026-81552Published
DataStage on Cloud Pak for Data has several vulnerabilities
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
CVE-2026-17413Published
This Power System update is being released to address
cve-program ·
Vendor product: PowerVM Hypervisor
CVE-2026-90481Published
In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.
cve-program ·
Vendor product: Burp Suite DAST
CVE-2026-82093Published
DataStage on Cloud Pak for Data has several vulnerabilities
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
CVE-2026-18857Published
This Power System update is being released to address
cve-program ·
Vendor product: OPENBMC
CVE-2026-65422Published
A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails.
cve-program ·
Vendor product: Genetec Security Center
CVE-2026-77703Published
SSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine
cve-program ·
Vendor product: Liman Render Engine
CVE-2026-77874Published
IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
cve-program ·
Vendor product: Enterprise Build of Quarkus
CVE-2026-81545Published
DataStage on Cloud Pak for Data has several vulnerabilities
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
CVE-2026-59167Published
SunEditor: Critical XSS vulnerability - sanitizer bypass
cve-program ·
Vendor product: suneditor
CVE-2026-56736Published
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
cve-program ·
Vendor product: phpMyFAQ
CVE-2026-12559Published
Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application
cve-program ·
Vendor product: Vendor Invoice Management for SAP Solutions
CVE-2026-19492Published
This Power System update is being released to address
cve-program ·
Vendor product: PowerVM Hypervisor
CVE-2026-86930Published
An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerab…
cve-program ·
Vendor product: FileMaker Server
CVE-2026-77798Published
Velociraptor Authenticated Denial of Service
cve-program ·
Vendor product: Velociraptor
CVE-2026-86926Published
A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerab…
cve-program ·
Vendor product: FileMaker Server
CVE-2026-91187Published
Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy
cve-program ·
https://repo.hex.pm: nimble_zta · https://github.com: dashbitco/nimble_zta
GHSA-5vv4-hvf7-2h46Published
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
osv · CVE-2026-26318
npm: systeminformation
RUSTSEC-2026-0308Published
Use-after-free in interned values and cached function results
osv · GHSA-xc3w-55vh-cw3w
crates.io: salsa
CVE-2026-86938Published
A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is…
cve-program ·
Vendor product: FileMaker Pro
CVE-2026-88916Published
Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF
cve-program ·
Vendor product: UlakPDF
CVE-2026-88907Published
SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF
cve-program ·
Vendor product: UlakPDF
CVE-2026-81645Published
Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.
cve-program ·
Vendor product: HarmonyOS
CVE-2026-86934Published
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing int…
cve-program ·
Vendor product: FileMaker Server
CVE-2026-82356Published
Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
cve-program ·
Vendor product: Imprivata Enterprise Access Management
CVE-2026-86867Published
Cinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers
cve-program ·
Vendor product: Kotaemon
CVE-2026-85682Published
YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
cve-program ·
Vendor product: YOP Poll
CVE-2026-3253Published
MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion
cve-program ·
Vendor product: MailerLite – Signup forms (official)
CVE-2026-96764Published
kvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources
cve-program ·
Vendor product: mooncake
CVE-2026-97182Published
halo-dev Halo SpEL ReplyNotificationSubscriptionHelper.java neutralization
cve-program ·
Vendor product: Halo
CVE-2026-17504Published
This Power System update is being released to address
cve-program ·
Vendor product: PowerVM Hypervisor
CVE-2026-66076Published
RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure
cve-program ·
Vendor product: rabbitmq-server
CVE-2026-96551Published
sfturing hosp_order CommonUserController.java cross-site request forgery
cve-program ·
Vendor product: hosp_order
CVE-2026-68490Published
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
cve-program ·
Vendor product: cPanel
CVE-2026-68492Published
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.
cve-program ·
Vendor product: Plesk · Vendor product: Plesk extension "Plesk RESTful API"
CVE-2026-77271Published
MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)
cve-program ·
Vendor product: mcp-atlassian
CVE-2026-66072Published
RabbitMQ: Atom table exhaustion via stream `chunk_selector`
cve-program ·
Vendor product: rabbitmq-server
CVE-2026-63002Published
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
cve-program ·
Vendor product: core
CVE-2026-67240Published
RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard
cve-program ·
Vendor product: rabbitmq-server
CVE-2026-96600Published
Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks
cve-program ·
Vendor product: isotope-core
CVE-2026-96599Published
Isotope eCommerce through 2.9.10 Weak Order Identifier Generation
cve-program ·
Vendor product: isotope-core
CVE-2026-96560Published
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel
cve-program ·
Vendor product: LightLLM
CVE-2026-96271Published
Photoview through 2.4.0 Authorization Bypass via shareAlbum
cve-program ·
Vendor product: photoview
CVE-2026-93873Published
Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin
cve-program ·
Vendor product: Cotonti
CVE-2026-93872Published
Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter
cve-program ·
Vendor product: Cotonti
CVE-2026-93871Published
Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
cve-program ·
Vendor product: Cotonti
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.