GHSA-j5cx-ph8g-95v3Published
Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of service
osv · CVE-2026-68523 · RUSTSEC-2026-0200
crates.io: fulgur
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699276 source statements · aliases may refer to the same vulnerabilityGHSA-4rf6-qx84-q9fvPublished
Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)
osv · CVE-2026-68537 · RUSTSEC-2026-0201
crates.io: fulgur
CVE-2026-85104Published
Brain stimulation parameters can be modified via Bluetooth in Sooma
cve-program ·
Vendor product: Sooma tDCS Home Therapy
CVE-2026-92087Published
@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth
cve-program ·
Vendor product: @fastify/auth
CVE-2026-54504Published
MCP Documentation Server: Web UI API binds to all interfaces without authentication by default
cve-program ·
Vendor product: mcp-documentation-server
CVE-2026-52727Published
lxc-ci: Pacman keyring stored in archlinux image with a private key
cve-program ·
Vendor product: lxc-ci
CVE-2026-92992Published
Dromara mayfly-go AI Assistant ai.go authorization
cve-program ·
Vendor product: mayfly-go
CVE-2026-87576Published
Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: …
cve-program ·
Vendor product: Chrome
CVE-2026-84650Published
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, th…
cve-program ·
Vendor product: Jenkins
CVE-2026-84649Published
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving…
cve-program ·
Vendor product: Jenkins
CVE-2026-84647Published
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Stapler does not restrict the types of objects that can be instantiated via form data binding to th…
cve-program ·
Vendor product: Jenkins
CVE-2026-84639Published
Uninitialized memory in MIME parsing
cve-program ·
Vendor product: Thunderbird
CVE-2026-52851Published
Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions
cve-program ·
Vendor product: traccar
CVE-2026-80159Published
Acrobat Reader | Untrusted Search Path (CWE-426)
cve-program ·
Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024
CVE-2026-54524Published
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
cve-program ·
Vendor product: hrms
CVE-2026-73177Published
Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through…
cve-program ·
Vendor product: EKI-1242IEIMS · Vendor product: EKI-1242EIMS
CVE-2026-73176Published
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that …
cve-program ·
Vendor product: EKI-1242IEIMS · Vendor product: EKI-1242EIMS
CVE-2026-79191Published
Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium…
cve-program ·
Vendor product: Chrome
CVE-2026-73175Published
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows an adjacent unauthenticated attacker to exhaust th…
cve-program ·
Vendor product: EKI-1242IEIMS · Vendor product: EKI-1242EIMS
CVE-2026-82874Published
ToolJet before v3.16.208 Cross-Tenant Authorization Bypass via tooljet-db
cve-program ·
Vendor product: ToolJet
CVE-2026-73033Published
Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php
cve-program ·
Vendor product: sucuri-wordpress-plugin
CVE-2026-69116Published
FlyEnv < 4.18.0 Cross-Site Scripting via v-html
cve-program ·
Vendor product: FlyEnv
CVE-2026-69114Published
Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass
cve-program ·
Vendor product: Spacebar Server
CVE-2026-63764Published
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
cve-program ·
Vendor product: lmdeploy
CVE-2026-59258Published
immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser
cve-program ·
Vendor product: immich
CVE-2026-59255Published
BloodHound Missing Authorization on Custom Node Management API
cve-program ·
Vendor product: BloodHound
CVE-2026-56694Published
NanoClaw < 2.1.0 - Privilege Escalation via Forged Channel Approval Callback
cve-program ·
Vendor product: nanoclaw
CVE-2026-56693Published
NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action
cve-program ·
Vendor product: nanoclaw
CVE-2026-56692Published
NanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles
cve-program ·
Vendor product: nanoclaw
CVE-2026-56402Published
NanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler
cve-program ·
Vendor product: nanoclaw
CVE-2026-55205Published
Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint
cve-program ·
Vendor product: hermes-webui
CVE-2026-55198Published
Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint
cve-program ·
Vendor product: hermes-webui
CVE-2026-55197Published
Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint
cve-program ·
Vendor product: hermes-webui
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.