CVE-2026-90976Published
Clean Login < 1.19 - Unauthenticated Account Creation with Registration Disabled
cve-program ·
https://wordpress.org/plugins: Clean Login
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699261 source statements · aliases may refer to the same vulnerabilityCVE-2026-90977Published
Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison
cve-program ·
https://wordpress.org/plugins: Clean Login
CVE-2026-56595Published
HCL BigFix Service Management is affected by multiple security vulnerabilities.
cve-program ·
Vendor product: HCL BigFix Service Management
CVE-2026-40530Published
An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to read or write arbitr…
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-40534Published
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated user…
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-40537Published
A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information.
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-83561Published
Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex
cve-program ·
Vendor product: Complianz GDPR/CCPA Cookie Consent Banner
CVE-2026-40533Published
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information.
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-40535Published
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write lim…
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-40538Published
An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via brute-fo…
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-40539Published
An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denia…
cve-program ·
Vendor product: DiskStation Manager (DSM)
CVE-2026-21822Published
A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).
cve-program ·
Vendor product: HCL AppScan 360°
CVE-2026-15579Published
An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long…
cve-program ·
Vendor product: TN-4500B Series
CVE-2026-92976Published
Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0
cve-program ·
Vendor product: TAO
CVE-2026-90884Published
WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
cve-program ·
Vendor product: WP Recipe Maker
GHSA-459x-q9hg-4gpqPublished
Kyverno vulnerable to SSRF via Service Calls
osv · BIT-kyverno-2025-15613 · CVE-2025-15613 · GO-2025-3615
Go: github.com/kyverno/kyverno
GO-2025-3615Published
Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
osv · BIT-kyverno-2025-15613 · CVE-2025-15613 · GHSA-459x-q9hg-4gpq
Go: github.com/kyverno/kyverno
CVE-2026-85544Published
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, there…
cve-program ·
Vendor product: DS-KV9503 · Vendor product: DS-KV6113 · Vendor product: DS-KV6103
RUSTSEC-2026-0290Published
pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery
osv ·
crates.io: pqc_kyber
RUSTSEC-2026-0288Published
cosmian_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery
osv ·
crates.io: cosmian_kyber
CVE-2025-10072Published
Portabilis i-Educar enturmar access control
cve-program ·
Vendor product: i-Educar
CVE-2026-19387Published
Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: gstreamer1-plugins-bad-free · https://access.redhat.com/downloads/content/package-browser/: gstreamer1-plugins-bad-free · https://access.redhat.com/downloads/content/package-browser/: gstreamer1-plugins-bad-free
GHSA-2h9g-j24r-h63gPublished
Orval: Import-time RCE via array-items default -> zod module-level template literal
osv · CVE-2026-71869
npm: orval
GHSA-3575-w9fc-c2j6Published
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
osv · CVE-2026-71868
npm: orval
GHSA-fg9p-mrxr-hvq7Published
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
osv · CVE-2026-62681
npm: orval
GHSA-88f2-fpv8-89q2Published
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
osv · CVE-2026-62682
npm: orval
GHSA-6437-gxhq-pqv8Published
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
osv · CVE-2026-71864
npm: orval
GHSA-w727-8j6c-2rj4Published
Orval: Import-time RCE via schema default -> zod module-level template literal
osv · CVE-2026-72717
npm: orval
GHSA-653q-5476-x79gPublished
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
osv · CVE-2026-71865
npm: orval
CVE-2026-26950Published
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of …
cve-program ·
Vendor product: SmartFabric Manager
CVE-2026-20360Published
Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Information Exposure & Insecure Handling
cve-program ·
Vendor product: Cisco Nexus Dashboard
CVE-2026-20340Published
Cisco Secure Firewall Management Center Software Deserialization Arbitrary Root Command Execution Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Management Center (FMC)
GHSA-v836-6xw4-9cx3Published
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
osv · CVE-2026-92961
npm: vm2
GHSA-q3fm-4wcw-g57xPublished
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
osv · CVE-2026-92962
npm: vm2
CVE-2026-81447Published
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to I…
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
CVE-2026-65357Published
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memo…
cve-program ·
Vendor product: iOS and iPadOS · Vendor product: macOS · Vendor product: tvOS
CVE-2026-20341Published
Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Management Center (FMC)
CVE-2026-20242Published
Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Management Center (FMC)
CVE-2026-20361Published
Cisco Nexus Dashboard Software Security Hardening Release September 2026 - SQL Injection
cve-program ·
Vendor product: Cisco Nexus Dashboard
CVE-2026-20324Published
Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Management Center (FMC)
CVE-2026-81445Published
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of p…
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
CVE-2026-20194Published
Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities
cve-program ·
Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector
CVE-2026-81477Published
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
CVE-2026-81478Published
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthor…
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
CVE-2026-81480Published
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
CVE-2026-81474Published
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privile…
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.