CVE-2026-76194Published
CAI Content Credentials | Improper Input Validation (CWE-20)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: Content Credentials Command-Line Tool
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699106 source statements · aliases may refer to the same vulnerabilityCVE-2026-19480Published
CAI Content Credentials | Improper Input Validation (CWE-20)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: Content Credentials Command-Line Tool
CVE-2026-93012Published
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe
cve-program ·
https://cpan.org/modules: Email-Sender
CVE-2026-93710Published
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks
cve-program ·
https://cpan.org/modules: Dancer2
CVE-2026-93711Published
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array
cve-program ·
https://cpan.org/modules: Dancer2
CVE-2026-75697Published
Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Connect · Vendor product: Adobe Connect Android Mobile App
CVE-2026-94462Published
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
cve-program ·
Vendor product: spree
CVE-2026-93712Published
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler
cve-program ·
https://cpan.org/modules: Dancer2
CVE-2026-70410Published
Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.calcite.avatica:avatica-core
CVE-2026-57149Published
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
cve-program ·
Vendor product: plone.app.portlets
CVE-2026-75744Published
Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: AEM 6.5 Forms JEE · Vendor product: AEM 6.5 LTS Forms JEE
CVE-2026-48361Published
Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Connect · Vendor product: Adobe Connect Android Mobile App
CVE-2026-75634Published
CAI Content Credentials | Improper Input Validation (CWE-20)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: Content Credentials Command-Line Tool
CVE-2026-77256Published
MCP Atlassian: OAuth refresh-token backup file is world-readable under default Unix umask
cve-program ·
Vendor product: mcp-atlassian
CVE-2026-76192Published
InDesign Desktop | NULL Pointer Dereference (CWE-476)
cve-program ·
Vendor product: InDesign Desktop · Vendor product: InDesign Desktop
CVE-2026-77266Published
MCP Atlassian: Path traversal in upload_attachment allows arbitrary file read and exfiltration via MCP tool call
cve-program ·
Vendor product: mcp-atlassian
CVE-2025-7062Published
Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
cve-program ·
Vendor product: h5p-nodejs-library
CVE-2026-95660Published
Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection
cve-program ·
Vendor product: Kimi Code
CVE-2026-77254Published
MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials
cve-program ·
Vendor product: mcp-atlassian
CVE-2026-77243Published
MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass
cve-program ·
Vendor product: mcp-atlassian
CVE-2026-77247Published
MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters
cve-program ·
Vendor product: mcp-atlassian
CVE-2026-11388Published
Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation.
cve-program ·
Vendor product: connext_professional
CVE-2026-77253Published
MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files
cve-program ·
Vendor product: mcp-atlassian
CVE-2026-11389Published
Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.
cve-program ·
Vendor product: connext_professional
CVE-2026-77242Published
MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)
cve-program ·
Vendor product: mcp-atlassian
CVE-2026-18457Published
Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.
cve-program ·
Vendor product: connext_professional
CVE-2026-18458Published
Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.
cve-program ·
Vendor product: connext_professional
CVE-2026-18459Published
Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality.
cve-program ·
Vendor product: connext_professional
CVE-2026-18460Published
Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.
cve-program ·
Vendor product: connext_professional
CVE-2026-18461Published
Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.
cve-program ·
Vendor product: connext_professional
CVE-2026-18462Published
Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.
cve-program ·
Vendor product: connext_professional
CVE-2026-18626Published
Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.
cve-program ·
Vendor product: connext_professional
MAL-2026-16323Published
Malicious code in action-slack-message-root (npm)
osv · GHSA-mrmw-mqq6-fp9w
npm: action-slack-message-root
MAL-2026-16358Published
Malicious code in @uh-platform/cloud (npm)
osv · GHSA-xrhc-2pph-j3f7
npm: @uh-platform/cloud
MAL-2026-16359Published
Malicious code in @uh-platform/domain-widget (npm)
osv · GHSA-c842-qvgg-5vpf
npm: @uh-platform/domain-widget
MAL-2026-16360Published
Malicious code in @uh-platform/nadaver (npm)
osv · GHSA-v7wx-gg27-6p9g
npm: @uh-platform/nadaver
MAL-2026-16370Published
Malicious code in @uol-afiliados/affiliated-config-lib (npm)
osv · GHSA-mx57-mmpv-mwjr
npm: @uol-afiliados/affiliated-config-lib
MAL-2026-16324Published
Malicious code in better-envforge (npm)
osv · GHSA-3h54-43fv-m822
npm: better-envforge
MAL-2026-16357Published
Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)
osv · GHSA-xxcj-347q-8rrr
npm: @asdfaskdjfksadhfkasf/nadaver2
MAL-2026-16329Published
Malicious code in chai-as-viem (npm)
osv · GHSA-88fm-v2m3-mx8x
npm: chai-as-viem
MAL-2026-16299Published
Malicious code in @pwaplatform/module-sso-integration (npm)
osv · GHSA-3gx2-xpw8-x42p
npm: @pwaplatform/module-sso-integration
MAL-2026-16361Published
Malicious code in @uh-platform/nadaver2 (npm)
osv · GHSA-x2pw-3pc4-xvh5
npm: @uh-platform/nadaver2
MAL-2026-16362Published
Malicious code in @uh-platform/webcard (npm)
osv · GHSA-7w7p-g9xr-2v29
npm: @uh-platform/webcard
CVE-2026-77250Published
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
cve-program ·
Vendor product: mcp-atlassian
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.