Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699219 source statements · aliases may refer to the same vulnerabilityMalicious code in @nimbusedge2/authxsas (npm)
osv ·
npm: @nimbusedge2/authxsas
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows …
cve-program ·
Vendor product: Oracle Commerce Guided Search / Oracle Commerce Experience Manager
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticate…
cve-program ·
Vendor product: Oracle BI Publisher
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compr…
cve-program ·
Vendor product: Helidon
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticate…
cve-program ·
Vendor product: Oracle Hyperion Data Relationship Management
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthentica…
cve-program ·
Vendor product: Oracle Hyperion Data Relationship Management
Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows high privile…
cve-program ·
Vendor product: Oracle Hyperion Data Relationship Management
Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with net…
cve-program ·
Vendor product: Oracle HRMS (India)
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network acces…
cve-program ·
Vendor product: Oracle Purchasing
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.11-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network acce…
cve-program ·
Vendor product: Oracle Purchasing
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.10-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network acce…
cve-program ·
Vendor product: Oracle Purchasing
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with n…
cve-program ·
Vendor product: Oracle Hyperion Financial Management
Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF
cve-program ·
Vendor product: Sign-up Sheets
Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
cve-program ·
https://wordpress.org/plugins: Yo
TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption
cve-program ·
Vendor product: TikTok
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer
cve-program ·
Vendor product: Import and export users and customers
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
cve-program ·
Vendor product: Import and export users and customers
Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts
cve-program ·
Vendor product: Meow Gallery
Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route
cve-program ·
Vendor product: Meow Gallery
Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering
cve-program ·
Vendor product: Tripzzy
Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
cve-program ·
Vendor product: Tripzzy
Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
cve-program ·
Vendor product: Forminator Forms
Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
cve-program ·
Vendor product: Forminator Forms
Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
cve-program ·
Vendor product: Unlimited Elements For Elementor
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
cve-program ·
Vendor product: Kirki
SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
cve-program ·
Vendor product: SAML Single Sign On
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
cve-program ·
Vendor product: Photo Gallery, Sliders, Proofing and Themes
Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
cve-program ·
Vendor product: Import and export users and customers
Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes
cve-program ·
Vendor product: Master Slider
Dancer2 versions before 2.2.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable
cve-program ·
https://cpan.org/modules: Dancer2
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
cve-program ·
Vendor product: Cloud Pak for Business Automation
IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures
cve-program ·
Vendor product: ContextForge MCP Gateway
Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.