CVE-2026-84446Published
libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames
cve-program ·
Vendor product: libheif
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699171 source statements · aliases may refer to the same vulnerabilityCVE-2026-93737Published
Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet
cve-program ·
Vendor product: azkaban
CVE-2026-84450Published
libheif: `clap` + oversized `ispe` aborts on an assert in `Fraction::Fraction` (incomplete fix for CVE-2026-62289)
cve-program ·
Vendor product: libheif
CVE-2026-81515Published
Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)
cve-program ·
Vendor product: security-advisories
CVE-2026-62943Published
btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh
cve-program ·
Vendor product: btrbk
CVE-2026-61795Published
Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation
cve-program ·
Vendor product: capsule
CVE-2026-77608Published
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-61548Published
Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data
cve-program ·
Vendor product: rsyslog
CVE-2026-77610Published
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-77396Published
PJSIP: Heap buffer overflow in the AVI parser
cve-program ·
Vendor product: pjproject
CVE-2026-62278Published
LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory
cve-program ·
Vendor product: lubelog
CVE-2026-61550Published
Icinga 2: Improper access control for JSON-RPC update certificate messages
cve-program ·
Vendor product: icinga2
CVE-2026-69184Published
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
cve-program ·
Vendor product: c-ares
CVE-2026-86039Published
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
cve-program ·
Vendor product: js-libp2p
CVE-2026-32641Published
Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware
cve-program ·
Vendor product: parseable
CVE-2026-81181Published
SysReptor: Session Fixation in Password-Protected Shared Notes
cve-program ·
Vendor product: sysreptor
CVE-2023-54399Published
Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree
cve-program ·
Vendor product: e-HR
CVE-2026-76901Published
CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts
cve-program ·
Vendor product: CordysCRM
CVE-2026-58264Published
FluidSynth: Heap-based buffer overrun
cve-program ·
Vendor product: fluidsynth
CVE-2026-61723Published
FluidSynth: DLS ptbl Chunk Integer Overflow
cve-program ·
Vendor product: fluidsynth
CVE-2026-57228Published
Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder
cve-program ·
Vendor product: suricata
CVE-2026-93013Published
RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal
cve-program ·
Vendor product: ragflow
CVE-2026-63449Published
Suricata sip: large SIP message bodies can evade detection with frame keyword
cve-program ·
Vendor product: suricata
CVE-2026-71418Published
Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption
cve-program ·
Vendor product: suricata
CVE-2026-61670Published
microsandbox: Secret values exposed in world-readable process arguments
cve-program ·
Vendor product: microsandbox
CVE-2026-93981Published
hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
cve-program ·
Vendor product: hono
CVE-2026-93986Published
rclone before 1.75.1 Path Traversal via Directory Listing Names
cve-program ·
Vendor product: rclone
CVE-2026-93991Published
Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
cve-program ·
Vendor product: argo-workflows
CVE-2026-94106Published
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
cve-program ·
Vendor product: getid3
CVE-2026-94112Published
mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack
cve-program ·
Vendor product: ezBookkeeping
CVE-2026-63459Published
Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
cve-program ·
Vendor product: vendure
CVE-2026-61630Published
nginx ignition has TOTP Reuse During Validity Window
cve-program ·
Vendor product: nginx-ignition
CVE-2026-55060Published
GoCD is vulnerable to authorization bypass via support process list API
cve-program ·
Vendor product: gocd
CVE-2026-55870Published
GoCD is vulnerable to credential exposure when admins insecurely configure material URLs
cve-program ·
Vendor product: gocd
CVE-2026-61687Published
hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
cve-program ·
Vendor product: hatchet
CVE-2026-82412Published
ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API
cve-program ·
Vendor product: ntopng
CVE-2026-83621Published
ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs
cve-program ·
Vendor product: ntopng
CVE-2026-77560Published
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
cve-program ·
Vendor product: tinyauth
CVE-2026-59168Published
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS
cve-program ·
Vendor product: dasel
CVE-2026-85077Published
Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
cve-program ·
Vendor product: sanic
CVE-2026-61612Published
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
cve-program ·
Vendor product: ckan-mcp-server
CVE-2026-48826Published
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
cve-program ·
Vendor product: homebox
CVE-2026-92984Published
HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier
cve-program ·
Vendor product: hubzero-cms
CVE-2026-92959Published
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
cve-program ·
Vendor product: vm2
MAL-2026-16363Published
Malicious code in blue-string-formatter-utilss (npm)
osv ·
npm: blue-string-formatter-utilss
CVE-2024-40766Published
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects Sonic…
cve-program ·
Vendor product: SonicOS
CVE-2026-93955Published
grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization
cve-program ·
Vendor product: grimmory
CVE-2026-93980Published
code-projects Internship Management System Admin Login Form login.php sql injection
cve-program ·
Vendor product: Internship Management System
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.