CVE-2026-82310Published
Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
cve-program ·
https://pypi.python.org: apache-airflow-providers-fab
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699276 source statements · aliases may refer to the same vulnerabilityCVE-2026-92582Published
AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
cve-program ·
Vendor product: AVideo
CVE-2026-92592Published
Craft CMS before 4.18.6 Remote Code Execution via signed cookie
cve-program ·
Vendor product: cms · Vendor product: cms
CVE-2026-92597Published
Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
cve-program ·
Vendor product: nodemailer
CVE-2026-61592Published
djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)
cve-program ·
Vendor product: djust
CVE-2026-61589Published
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
cve-program ·
Vendor product: djust
CVE-2026-92914Published
AVideo LoginControl PGP Second Factor Authentication Bypass
cve-program ·
Vendor product: AVideo
CVE-2026-75588Published
Mattermost Desktop App plugin popout scheme validation bypass
cve-program ·
Vendor product: Mattermost
CVE-2026-76186Published
Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
cve-program ·
https://pypi.python.org: apache-airflow-providers-keycloak
CVE-2026-81481Published
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exp…
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
CVE-2026-62108Published
WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability
cve-program ·
https://wordpress.org/plugins: headless-single-sign-on
CVE-2026-66575Published
WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability
cve-program ·
https://wordpress.org/plugins: king-addons
CVE-2026-66580Published
WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: best-woocommerce-feed
CVE-2026-76187Published
Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
cve-program ·
https://pypi.python.org: apache-airflow-providers-keycloak
CVE-2026-66624Published
WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: wpmastertoolkit
CVE-2026-66631Published
WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: smart-wishlist-for-more-convert
CVE-2026-74005Published
WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
cve-program ·
https://wordpress.org/plugins: organize-series
CVE-2026-90887Published
WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: wp-inventory-manager
CVE-2026-86466Published
Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
cve-program ·
https://pypi.python.org: apache-airflow-providers-fab
CVE-2026-92935Published
vm2 NodeVM Remote Code Execution via Array-Shaped Require
cve-program ·
Vendor product: vm2
CVE-2026-92940Published
vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
cve-program ·
Vendor product: vm2
CVE-2026-92946Published
vm2 before 3.11.7 Remote Code Execution via require.external
cve-program ·
Vendor product: vm2
CVE-2026-92951Published
vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
cve-program ·
Vendor product: vm2
CVE-2026-92956Published
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
cve-program ·
Vendor product: vm2
CVE-2026-81453Published
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially explo…
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
CVE-2026-92986Published
SiYuan before 3.8.4 Cross-Site Scripting via Document Title
cve-program ·
Vendor product: siyuan
CVE-2026-85078Published
sanic chunked trailer request smuggling allows hidden second request execution
cve-program ·
Vendor product: sanic
CVE-2026-63461Published
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
cve-program ·
Vendor product: vendure
CVE-2026-93015Published
BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write
cve-program ·
Vendor product: BTstack
CVE-2026-59739Published
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.zookeeper:zookeeper
CVE-2026-86040Published
libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS
cve-program ·
Vendor product: js-libp2p · Vendor product: floodsub
CVE-2026-81516Published
Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
cve-program ·
Vendor product: security-advisories
CVE-2026-12284Published
Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler
cve-program ·
Vendor product: Mattermost
CVE-2026-86861Published
pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check
cve-program ·
Vendor product: pgAdmin 4
CVE-2026-54581Published
mport bootstrap index fetch can continue after hash verification failure
cve-program ·
Vendor product: mport
CVE-2026-59969Published
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.zookeeper:zookeeper
CVE-2026-79993Published
Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.zookeeper:zookeeper
CVE-2026-54582Published
mport package installation can overwrite existing unmanaged or differently owned files
cve-program ·
Vendor product: mport
CVE-2026-54587Published
mport directory asset installation is vulnerable to symlink and path traversal races
cve-program ·
Vendor product: mport
GHSA-955m-rr6m-2f9vPublished
@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
osv · CVE-2026-76969
npm: @sap/cds-mtxs · npm: @sap/cds-mtxs · npm: @sap/cds-mtxs
CVE-2026-84439Published
Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.zookeeper:zookeeper
CVE-2026-54446Published
NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
cve-program ·
Vendor product: NetLicensing-MCP
CVE-2026-76646Published
Apache MyFaces: Denial of Service via Unbounded Request Parsing
cve-program ·
Vendor product: Apache MyFaces
CVE-2026-87976Published
Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.nifi.registry:nifi-registry-framework
CVE-2026-89038Published
Verizon Cloud for Android < 26.7.10 Path Traversal via OneTouchUploadActivity
cve-program ·
Vendor product: com.vcast.mediamanager
CVE-2026-86089Published
Apache NiFi: Missing Process Group Authorization for Connector Migration
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.nifi:nifi-web-api
CVE-2026-82561Published
Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.nifi:nifi-web-api
CVE-2026-47252Published
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)
cve-program ·
Vendor product: anyquery · Vendor product: github.com/julien040/anyquery/plugins/brave · Vendor product: github.com/julien040/anyquery/plugins/chrome
CVE-2026-49292Published
Kiwi TCMS: The /init-db/ page renders and responds to requests after first use
cve-program ·
Vendor product: Kiwi
CVE-2026-73166Published
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated att…
cve-program ·
Vendor product: EKI-1242IEIMS · Vendor product: EKI-1242EIMS
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.