CVE-2026-31710Published
smb: client: fix dir separator in SMB1 UNIX mounts
cve-program ·
Vendor product: Linux · Vendor product: Linux
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699210 source statements · aliases may refer to the same vulnerabilityCVE-2026-83549Published
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentiall…
cve-program ·
Vendor product: SMA1000
CVE-2026-20350Published
Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability
cve-program ·
Vendor product: Cisco ThousandEyes Enterprise Agent
CVE-2025-15399Published
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
cve-program ·
Vendor product: Common Licensing
CVE-2026-10027Published
IBM MQ queue manager is vulnerable to unauthenticated remote code execution
cve-program ·
Vendor product: MQ
CVE-2026-10575Published
IBM MQ queue manager is vulnerable to remote code execution
cve-program ·
Vendor product: MQ
CVE-2026-10747Published
IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing
cve-program ·
Vendor product: MQ Appliance
CVE-2026-10751Published
IBM MQ Java messaging is vulnerable to remote code execution
cve-program ·
Vendor product: MQ
CVE-2026-10853Published
IBM MQ queue manager is vulnerable to remote code execution
cve-program ·
Vendor product: MQ
CVE-2026-11375Published
IBM MQ queue manager is vulnerable to remote code execution
cve-program ·
Vendor product: MQ
CVE-2026-11378Published
IBM MQ queue manager is vulnerable to remote code execution
cve-program ·
Vendor product: MQ
CVE-2026-82927Published
Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.
cve-program ·
Vendor product: mTower
CVE-2026-82926Published
NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.
cve-program ·
Vendor product: mTower
CVE-2026-18620Published
Data-sciences-pipeline: user-controlled serviceaccount for workflow pods without authorization check — confused deputy
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-ml-pipelines-api-server-v2-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-ml-pipelines-api-server-v2-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-ml-pipelines-api-server-v2-rhel9
CVE-2026-18611Published
Data-science-pipelines-operator: dspo: cryptographically weak secret generation (math/rand) for db and s3 credentials
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-data-science-pipelines-operator-controller-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-data-science-pipelines-operator-controller-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-data-science-pipelines-operator-controller-rhel9
CVE-2026-89060Published
Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references
cve-program ·
https://github.com/stolostron/multicluster-observability-addon: multicluster-observability-addon · https://catalog.redhat.com/software/containers/: rhacm2/acm-multicluster-observability-addon-rhel9 · https://catalog.redhat.com/software/containers/: rhacm2/acm-multicluster-observability-addon-rhel9
CVE-2026-94277Published
Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
cve-program ·
Vendor product: MISP
CVE-2026-91921Published
Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform
cve-program ·
Vendor product: AI Chatbot Platform (SaaS) de 1millionbot.
CVE-2026-92612Published
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can th…
cve-program ·
Vendor product: Eclipse iceoryx™
CVE-2026-68569Published
Apache Tomcat: Principal lookup can fail open in some cases
cve-program ·
Vendor product: Apache Tomcat
CVE-2026-94049Published
06ketan slideshot renderer.ts render_slides path traversal
cve-program ·
Vendor product: slideshot
CVE-2026-81796Published
WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
cve-program ·
https://wordpress.org/plugins: wp-travel
CVE-2026-94091Published
piskvorky gensim Model Loader utils.py load deserialization
cve-program ·
Vendor product: gensim
CVE-2025-68598Published
WordPress Page Builder: Live Composer plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: live-composer-page-builder
CVE-2024-35768Published
WordPress Page Builder: Live Composer plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: live-composer-page-builder
CVE-2026-94096Published
Netcore NBR200V2 LAN IP Configuration network_tools command injection
cve-program ·
Vendor product: NBR200V2
CVE-2026-94101Published
Netcore NBR200V2 routerd vlan_load_form_uci buffer overflow
cve-program ·
Vendor product: NBR200V2
CVE-2026-94129Published
BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where
cve-program ·
Vendor product: VALKYRIE AURORA
CVE-2026-18982Published
Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit/admin clusterroles
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-training-operator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-training-operator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-training-operator-rhel9
CVE-2026-94149Published
Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection
cve-program ·
Vendor product: HRM OS
CVE-2026-18617Published
Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextraparams enables local infile file exfiltration from operator pod
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-data-science-pipelines-operator-controller-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-data-science-pipelines-operator-controller-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-data-science-pipelines-operator-controller-rhel9
CVE-2026-18608Published
Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflow.org */*, and clusterrole/binding crud cluster-wide
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-data-science-pipelines-operator-controller-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-data-science-pipelines-operator-controller-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-data-science-pipelines-operator-controller-rhel9
CVE-2026-15467Published
Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override
cve-program ·
https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-service-operator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-service-operator-rhel9 · https://catalog.redhat.com/software/containers/: rhoai/odh-trustyai-service-operator-rhel9
CVE-2026-32551Published
WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability
cve-program ·
Vendor product: Woo Essential
GHSA-m2v6-2jmh-4c68Published
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization
osv · BIT-envoy-gateway-2026-53719 · CVE-2026-53719 · GO-2026-6009
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
GO-2026-6009Published
Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53719 · CVE-2026-53719 · GHSA-m2v6-2jmh-4c68
Go: github.com/envoyproxy/gateway
GHSA-cxpq-8v7q-cg56Published
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit
osv · BIT-envoy-gateway-2026-53716 · CVE-2026-53716 · GO-2026-6006
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
GO-2026-6006Published
Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53716 · CVE-2026-53716 · GHSA-cxpq-8v7q-cg56
Go: github.com/envoyproxy/gateway
GHSA-fcrp-7gc2-93g7Published
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
osv · BIT-envoy-gateway-2026-53718 · CVE-2026-53718 · GO-2026-6007
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
GO-2026-6007Published
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53718 · CVE-2026-53718 · GHSA-fcrp-7gc2-93g7
Go: github.com/envoyproxy/gateway
GHSA-wcrf-9vrr-854fPublished
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
osv · BIT-envoy-gateway-2026-53713 · CVE-2026-53713 · GO-2026-6011
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
GO-2026-6011Published
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway
osv · BIT-envoy-gateway-2026-53713 · CVE-2026-53713 · GHSA-wcrf-9vrr-854f
Go: github.com/envoyproxy/gateway
GHSA-h7pq-86h8-rp5xPublished
Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header
osv · BIT-envoy-gateway-2026-53717 · CVE-2026-53717 · GO-2026-6008
Go: github.com/envoyproxy/gateway · Go: github.com/envoyproxy/gateway
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.