CVE-2026-88788Published
Text Styler <= 1.1.1 - Contributor+ Stored XSS
cve-program ·
Vendor product: Text Styler
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699171 source statements · aliases may refer to the same vulnerabilityCVE-2026-92438Published
Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin
cve-program ·
https://wordpress.org/plugins: Ninja Forms
CVE-2026-91827Published
Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
cve-program ·
https://wordpress.org/plugins: Ninja Forms
CVE-2026-86482Published
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
cve-program ·
Vendor product: YouTrack
CVE-2025-48043Published
Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization
cve-program ·
https://repo.hex.pm: ash · https://github.com: ash-project/ash
CVE-2025-48044Published
Authorization bypass when bypass policy condition evaluates to true
cve-program ·
https://repo.hex.pm: ash · https://github.com: ash-project/ash
CVE-2025-48042Published
Before action hooks may execute in certain scenarios despite a request being forbidden
cve-program ·
https://repo.hex.pm: ash · https://github.com: ash-project/ash
CVE-2025-4754Published
Missing Session Revocation on Logout in ash_authentication_phoenix
cve-program ·
https://repo.hex.pm: ash_authentication_phoenix · https://github.com: team-alembic/ash_authentication_phoenix
CVE-2026-28808Published
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
cve-program ·
Vendor product: otp · Vendor product: inets · https://github.com: erlang/otp
CVE-2023-4547Published
SPA-Cart eCommerce CMS search cross site scripting
cve-program ·
Vendor product: eCommerce CMS
CVE-2023-4548Published
SPA-Cart eCommerce CMS GET Parameter search sql injection
cve-program ·
Vendor product: eCommerce CMS
RUSTSEC-2026-0298Published
Use-after-free when a future's `Drop` panics while the container is dropped
osv · GHSA-8gw6-724c-9h38
crates.io: unicycle
RUSTSEC-2026-0300Published
Use-after-free in `clear` and `retain` when an element's `Drop` panics
osv · GHSA-x6j6-3ffp-qrfr
crates.io: skiplist
CVE-2026-93295Published
MISP Background Job Argument Injection via Console Path Switches Enables Remote Code Execution
cve-program ·
Vendor product: misp
CVE-2026-93296Published
MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends
cve-program ·
Vendor product: misp
CVE-2026-66457Published
WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: events-manager
CVE-2026-88857Published
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
cve-program ·
Vendor product: com_osgallery_light · Vendor product: com_osgallery
CVE-2026-88854Published
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
cve-program ·
Vendor product: com_osgallery_light · Vendor product: com_osgallery
CVE-2026-88855Published
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
cve-program ·
Vendor product: com_osgallery_light · Vendor product: com_osgallery
CVE-2026-88856Published
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
cve-program ·
Vendor product: com_osgallery_light · Vendor product: com_osgallery
CVE-2026-83283Published
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated…
cve-program ·
Vendor product: Oracle Business Intelligence Enterprise Edition
CVE-2026-83269Published
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticate…
cve-program ·
Vendor product: Oracle BI Publisher
CVE-2026-87268Published
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructu…
cve-program ·
Vendor product: Oracle VM VirtualBox
CVE-2026-87269Published
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructu…
cve-program ·
Vendor product: Oracle VM VirtualBox
CVE-2026-87270Published
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructu…
cve-program ·
Vendor product: Oracle VM VirtualBox
CVE-2026-87271Published
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructu…
cve-program ·
Vendor product: Oracle VM VirtualBox
CVE-2026-11727Published
IBM MQ for HPE NonStop is vulnerable to a denial of service issue
cve-program ·
Vendor product: MQ for HPE NonStop
CVE-2026-11725Published
IBM MQ queue manager is vulnerable to privilege escalation
cve-program ·
Vendor product: MQ
CVE-2026-11716Published
IBM MQ for HPE NonStop is vulnerable to a denial of service attack
cve-program ·
Vendor product: MQ for HPE NonStop
CVE-2026-94301Published
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
cve-program ·
Vendor product: Apache MINA
CVE-2026-87272Published
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructu…
cve-program ·
Vendor product: Oracle VM VirtualBox
CVE-2026-87273Published
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastruct…
cve-program ·
Vendor product: Oracle VM VirtualBox
CVE-2026-87276Published
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastruc…
cve-program ·
Vendor product: Oracle VM VirtualBox
CVE-2026-88806Published
libX11 XkbGetMap Reply Heap-based Buffer Overflow
cve-program ·
Vendor product: libX11
CVE-2026-88807Published
libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow
cve-program ·
Vendor product: libXrender
CVE-2026-87286Published
Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network acces…
cve-program ·
Vendor product: Oracle GraalVM
CVE-2026-87287Published
Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network acces…
cve-program ·
Vendor product: Oracle GraalVM
CVE-2026-87288Published
Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network acces…
cve-program ·
Vendor product: Oracle GraalVM
CVE-2026-83357Published
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle Gra…
cve-program ·
Vendor product: Oracle GraalVM for JDK, Oracle GraalVM
CVE-2026-83408Published
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle Gra…
cve-program ·
Vendor product: Oracle GraalVM for JDK, Oracle GraalVM
CVE-2026-7273Published
A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a c…
cve-program ·
Vendor product: GS1900-48HPv2 firmware · Vendor product: GS1900-8 firmware · Vendor product: GS1900-8HP firmware
MAL-2026-14298Published
Malicious code in emoji-prints-fancy (npm)
osv · GHSA-m523-mggx-3fgr
npm: emoji-prints-fancy
CVE-2023-6927Published
Keycloak: open redirect via "form_post.jwt" jarm response mode
cve-program ·
https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://access.redhat.com/downloads/content/package-browser/: keycloak-core · https://access.redhat.com/downloads/content/package-browser/: rh-sso7-keycloak
CVE-2023-6134Published
Keycloak: reflected xss via wildcard in oidc redirect_uri
cve-program ·
https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator
CVE-2023-6563Published
Keycloak: offline session token dos
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: rh-sso7-keycloak · https://access.redhat.com/downloads/content/package-browser/: rh-sso7-keycloak · https://access.redhat.com/downloads/content/package-browser/: rh-sso7-keycloak
CVE-2026-20516Published
In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11060…
cve-program ·
Vendor product: MediaTek chipset
CVE-2026-93314Published
Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow
cve-program ·
Vendor product: Poppler
CVE-2026-93309Published
O-RAN-SC SMO OAM VES Collector allocation of resources
cve-program ·
Vendor product: SMO OAM
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.