CVE-2026-75904Published
libmodplug <= 0.8.9.1 - Out-of-Bounds Read in pat_smplooped via Crafted MIDI File
cve-program ·
Vendor product: libmodplug
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698852 source statements · aliases may refer to the same vulnerabilityCVE-2026-75898Published
RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component
cve-program ·
Vendor product: ragflow
CVE-2026-75627Published
Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
cve-program ·
Vendor product: Bastillion
CVE-2026-75626Published
SpiderFoot Stored Cross-Site Scripting via Correlation Titles
cve-program ·
Vendor product: spiderfoot
CVE-2026-75625Published
Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass
cve-program ·
Vendor product: kraken
CVE-2026-75482Published
SWE-agent Trajectory Inspector Path Traversal File Disclosure
cve-program ·
Vendor product: SWE-agent
CVE-2026-75481Published
SkyPilot Authentication Bypass via Service Account Role Escalation
cve-program ·
Vendor product: skypilot
CVE-2026-75480Published
OpenViking Debug Vector Endpoints Multi-tenant Data Exposure
cve-program ·
Vendor product: OpenViking
CVE-2026-75479Published
JimuReport Unauthenticated Report Listing and Share Token Disclosure
cve-program ·
Vendor product: jimureport
CVE-2026-75111Published
Evidently UI Path Traversal via Dataset Materialization Filename
cve-program ·
Vendor product: evidently
CVE-2026-75110Published
MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET
cve-program ·
Vendor product: MemOS
CVE-2026-75109Published
Determined Missing Authorization Check on Generic Task Endpoints
cve-program ·
Vendor product: determined
CVE-2026-75108Published
Next Terminal Missing Per-Asset Authorization on Portal Endpoints
cve-program ·
Vendor product: next-terminal
CVE-2026-75107Published
Grav Form Plugin before 9.1.19 Stored XSS via Field Properties
cve-program ·
Vendor product: grav
CVE-2026-75105Published
phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter
cve-program ·
Vendor product: phpipam
CVE-2026-75104Published
Hugging Face Transformers Path Traversal via Checkpoint Index
cve-program ·
Vendor product: transformers
CVE-2026-75103Published
Crawlab Missing Authorization on Password Change Endpoint Allows Account Takeover
cve-program ·
Vendor product: crawlab
CVE-2026-73480Published
gdu Terminal Injection via Unstripped Escape Sequences
cve-program ·
Vendor product: gdu
CVE-2026-73479Published
dua-cli Terminal Escape Sequence Injection via Marked Paths
cve-program ·
Vendor product: dua-cli
CVE-2026-73040Published
Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion
cve-program ·
Vendor product: dockge
CVE-2026-73039Published
streama Insecure Direct Object Reference via ViewingStatusController
cve-program ·
Vendor product: streama
CVE-2026-72861Published
Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent
cve-program ·
Vendor product: templates
CVE-2026-85724Published
Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
cve-program ·
Vendor product: moquette
CVE-2026-72854Published
msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation
cve-program ·
Vendor product: msgpack-c
CVE-2026-72852Published
darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow
cve-program ·
Vendor product: darknet
CVE-2026-72847Published
broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View
cve-program ·
Vendor product: broot
CVE-2026-72818Published
NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input
cve-program ·
https://pypi.org: nltk
CVE-2026-72777Published
Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url
cve-program ·
Vendor product: next-ai-draw-io
CVE-2026-72776Published
AgenticSeek Unauthenticated RCE via /query API Endpoint
cve-program ·
Vendor product: AgenticSeek
CVE-2026-71993Published
MSI Radix AXE6600 v781521 Command Injection via openvpn function
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71992Published
MSI Radix AXE6600 v781521 Command Injection via macfilter
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71991Published
MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71990Published
MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71989Published
MSI Radix AXE6600 v781521 Command Injection via porTrigger function
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71988Published
MSI Radix AXE6600 v781521 Command Injection via portFw function
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71987Published
MSI Radix AXE6600 v781521 Command Injection via alg function
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71986Published
MSI Radix AXE6600 v781521 Command Injection via dmz Function
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71985Published
MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71984Published
MSI Radix AXE6600 v781521 Command Injection via urlfilter
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-71983Published
MSI Radix AXE6600 v781521 Command Injection via wps.cgi
cve-program ·
Vendor product: Radix AXE6600
CVE-2026-70561Published
TestLink 1.9.20 and prior Authenticated IDOR via attachmentdownload.php
cve-program ·
Vendor product: TestLink
CVE-2026-70556Published
Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration
cve-program ·
Vendor product: Hubzilla
CVE-2026-70554Published
MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie
cve-program ·
Vendor product: MaxSite CMS
CVE-2026-70552Published
MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
cve-program ·
Vendor product: MaxSite CMS
CVE-2026-69704Published
Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()
cve-program ·
Vendor product: Atals-Livre
CVE-2026-69703Published
Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit
cve-program ·
Vendor product: Atals-Livre
CVE-2026-69702Published
SnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOM
cve-program ·
Vendor product: SnailJob (snail-job)
CVE-2026-69101Published
Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint
cve-program ·
Vendor product: tis
CVE-2026-66421Published
OpenClaw Dashboard Stored XSS via lastMessage Session Field
cve-program ·
Vendor product: openclaw-dashboard
CVE-2026-66420Published
MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments
cve-program ·
Vendor product: MeshCentral
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.