CVE-2026-95679Published
MISP Unauthenticated Blind SSRF via XML Body Processing
cve-program ·
Vendor product: MISP
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699150 source statements · aliases may refer to the same vulnerabilityCVE-2026-95500Published
JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload
cve-program ·
Vendor product: php-file-manager-with-code-editor
CVE-2026-95658Published
MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules
cve-program ·
Vendor product: MISP
CVE-2026-95659Published
MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
cve-program ·
Vendor product: MISP
CVE-2026-95661Published
MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List
cve-program ·
Vendor product: MISP
CVE-2026-95665Published
MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
cve-program ·
Vendor product: MISP
CVE-2026-95667Published
MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
cve-program ·
Vendor product: MISP
CVE-2026-95671Published
MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add
cve-program ·
Vendor product: MISP
CVE-2026-95674Published
MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation
cve-program ·
Vendor product: MISP
CVE-2026-95682Published
MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View
cve-program ·
Vendor product: MISP
CVE-2026-79551Published
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
cve-program ·
Vendor product: n/a
CVE-2026-24267Published
NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to cod…
cve-program ·
Vendor product: NeMo Speech
CVE-2026-83279Published
Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the …
cve-program ·
Vendor product: Oracle Agile PLM MCAD Connector
CVE-2026-24239Published
NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, information disclosure, an…
cve-program ·
Vendor product: NeMo Speech
CVE-2026-65111Published
NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and da…
cve-program ·
Vendor product: NeMo Speech
CVE-2026-92068Published
Site isolation issue in the Reader Mode component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-65179Published
NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution…
cve-program ·
Vendor product: NeMo Speech
CVE-2026-95683Published
MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
cve-program ·
Vendor product: MISP
CVE-2026-65121Published
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentication issue. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, …
cve-program ·
Vendor product: Infrastructure Controller
CVE-2026-92069Published
Spoofing issue in the DOM: Navigation component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-65124Published
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service.
cve-program ·
Vendor product: Infrastructure Controller
CVE-2026-92070Published
Information disclosure in the Networking component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-65125Published
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, da…
cve-program ·
Vendor product: Infrastructure Controller
CVE-2026-65126Published
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and…
cve-program ·
Vendor product: Infrastructure Controller
CVE-2026-92071Published
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-94083Published
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This r…
cve-program ·
Vendor product: Suricata
CVE-2026-93854Published
In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to loa…
cve-program ·
Vendor product: Blazar
CVE-2026-65127Published
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to informat…
cve-program ·
Vendor product: Infrastructure Controller
CVE-2026-65128Published
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information dis…
cve-program ·
Vendor product: Infrastructure Controller
CVE-2026-65129Published
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial o…
cve-program ·
Vendor product: Infrastructure Controller
RUSTSEC-2026-0175Published
`onering` 1.4.1 was removed from crates.io for malicious code
osv ·
crates.io: onering
CVE-2026-81180Published
SysReptor: Authenticated RCE by insecure image processing
cve-program ·
Vendor product: sysreptor
CVE-2026-85058Published
Moquette: Missing Authorization in io.moquette:moquette-broker
cve-program ·
Vendor product: moquette
CVE-2026-95685Published
MISP Missing Authorization on replaceSuggestionInReport Event Report Action
cve-program ·
Vendor product: MISP
CVE-2026-91127Published
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
cve-program ·
Vendor product: file-viewer · Vendor product: doc · Vendor product: msdoc-viewer
CVE-2026-95693Published
MISP Information Disclosure via Forged Upload Path
cve-program ·
Vendor product: MISP
CVE-2026-77386Published
Kyoo: OIDC login token can be redirected to an attacker-controlled URL
cve-program ·
Vendor product: Kyoo
CVE-2026-33625Published
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
cve-program ·
Vendor product: lmdeploy
CVE-2026-65130Published
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and informat…
cve-program ·
Vendor product: Infrastructure Controller
CVE-2026-65113Published
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of se…
cve-program ·
Vendor product: Infrastructure Controller
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.