MAL-2026-11439Published
Malicious code in @global-theme/context (npm)
osv · GHSA-whq3-7x3r-pv39
npm: @global-theme/context
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698965 source statements · aliases may refer to the same vulnerabilityMAL-2024-1712Published
Malicious code in abb-americas (npm)
osv · GHSA-h6q5-gg65-2v92
npm: abb-americas
MAL-2026-2523Published
Malicious code in @telekom-wfa/auth-core (npm)
osv · GHSA-gg3w-7mmm-rv8g
npm: @telekom-wfa/auth-core
MAL-2024-11286Published
Malicious code in a111y-cloud (npm)
osv · GHSA-7439-3g93-546j
npm: a111y-cloud
MAL-2024-1709Published
Malicious code in a11y-test-app (npm)
osv · GHSA-wfhv-655r-8pp5
npm: a11y-test-app
MAL-2026-11434Published
Malicious code in @404c3s4r/lodash (npm)
osv · GHSA-3357-xmhq-8r86
npm: @404c3s4r/lodash
MAL-2026-14073Published
Malicious code in @veertly/web-app (npm)
osv · GHSA-cj2v-gp59-8682
npm: @veertly/web-app
MAL-2024-1708Published
Malicious code in a-constructor.js (npm)
osv · GHSA-3c2g-8fgr-mp33
npm: a-constructor.js
MAL-2024-1713Published
Malicious code in abcotv-xml-parser (npm)
osv · GHSA-7f64-pfcw-g8x6
npm: abcotv-xml-parser
RUSTSEC-2026-0307Published
`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
osv ·
crates.io: uncbv
MAL-2025-49165Published
Malicious code in epic-native-client-utils (npm)
osv ·
npm: epic-native-client-utils
MAL-2025-19703Published
Malicious code in epic-launcher-integration (npm)
osv ·
npm: epic-launcher-integration
MAL-2025-49160Published
Malicious code in epic-js-error-reporting (npm)
osv ·
npm: epic-js-error-reporting
CVE-2026-87899Published
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
cve-program ·
Vendor product: cPanel
CVE-2026-73588Published
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerabili…
cve-program ·
Vendor product: Secure Connect Gateway (SCG) Policy Manager
CVE-2026-61413Published
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to U…
cve-program ·
Vendor product: Secure Connect Gateway (SCG) Policy Manager
CVE-2026-86678Published
Broken Authentication vulnerability
cve-program ·
Vendor product: ManageEngine Applications Manager
CVE-2026-86683Published
Broken Authentication Vulnerability
cve-program ·
Vendor product: ManageEngine Applications Manager
CVE-2026-73586Published
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, …
cve-program ·
Vendor product: Secure Connect Gateway (SCG) Policy Manager
CVE-2026-73587Published
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability…
cve-program ·
Vendor product: Secure Connect Gateway (SCG) Policy Manager
CVE-2026-17472Published
Multiple Vulnerabilities in IBM Concert Software
cve-program ·
Vendor product: Concert
CVE-2026-49810Published
Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading t…
cve-program ·
Vendor product: Command Powershell Provider (DCPP)
CVE-2026-71290Published
Apache HttpComponents Client: TLS hostname verification silently disabled on the async transport (default config, MITM)
cve-program ·
https://repo.maven.apache.org/maven2/: org.apache.httpcomponents.client5:httpclient5
CVE-2026-86677Published
Broken Authentication vulnerability
cve-program ·
Vendor product: ManageEngine Applications Manager
CVE-2026-14913Published
SQL Injection vulnerability
cve-program ·
Vendor product: ManageEngine OpManager · Vendor product: ManageEngine Firewall Analyzer
CVE-2026-86708Published
Sensitive data exposure
cve-program ·
Vendor product: ManageEngine Applications Manager
CVE-2026-84787Published
Privilege Escalation vulnerability
cve-program ·
Vendor product: ManageEngine OpManager · Vendor product: ManageEngine Firewall Analyzer
CVE-2026-76978Published
Command Injection vulnerability
cve-program ·
Vendor product: ManageEngine OpManager · Vendor product: ManageEngine Firewall Analyzer
CVE-2026-75825Published
Authentication Bypass vulnerability
cve-program ·
Vendor product: ManageEngine OpManager
CVE-2026-19599Published
Remote Code Execution vulnerability
cve-program ·
Vendor product: ManageEngine OpManager
MAL-2025-49152Published
Malicious code in epic-google-maps-tools (npm)
osv ·
npm: epic-google-maps-tools
MAL-2022-2767Published
Malicious code in epic-games-nav-shared (npm)
osv · GHSA-xmcp-9g5c-f4vw
npm: epic-games-nav-shared
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.