MAL-2026-16062Published
Malicious code in @yongot/canary-mcp-test (npm)
osv ·
npm: @yongot/canary-mcp-test
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699309 source statements · aliases may refer to the same vulnerabilityCVE-2026-91849Published
WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload
cve-program ·
Vendor product: WuzhiCMS
CVE-2026-80356Published
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability…
cve-program ·
Vendor product: OpenManage Server Administrator Managed Node (Patch) for Windows · Vendor product: OpenManage Server Administrator Managed Node for RHEL 8.10 · Vendor product: OpenManage Server Administrator Managed Node for RHEL 9.4
CVE-2026-66625Published
WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: wc-vendors
CVE-2026-92985Published
SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
cve-program ·
Vendor product: siyuan
CVE-2026-55630Published
Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
cve-program ·
Vendor product: Kiwi
CVE-2026-83053Published
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attack…
cve-program ·
Vendor product: Oracle WebCenter Portal
CVE-2026-83055Published
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged at…
cve-program ·
Vendor product: Oracle Internet Directory
CVE-2026-83056Published
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged at…
cve-program ·
Vendor product: Oracle Internet Directory
CVE-2026-83057Published
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged at…
cve-program ·
Vendor product: Oracle Internet Directory
CVE-2026-83058Published
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged at…
cve-program ·
Vendor product: Oracle Internet Directory
CVE-2026-83063Published
Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged a…
cve-program ·
Vendor product: Oracle Internet Directory
CVE-2026-83064Published
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attac…
cve-program ·
Vendor product: Oracle WebCenter Portal
CVE-2026-83065Published
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with acc…
cve-program ·
Vendor product: Oracle WebCenter Portal
CVE-2026-83069Published
Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged a…
cve-program ·
Vendor product: Oracle Fusion Middleware Control
CVE-2026-83071Published
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Machine Learning). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows lo…
cve-program ·
Vendor product: Oracle Business Intelligence Enterprise Edition
CVE-2026-83072Published
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Search Bean [Incl. Advanced]). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileg…
cve-program ·
Vendor product: Oracle Applications Framework
CVE-2026-83073Published
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows unauthenticated attacker with ac…
cve-program ·
Vendor product: Siebel CRM Cloud Applications
CVE-2026-63472Published
Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification
cve-program ·
Vendor product: vendure
CVE-2026-83079Published
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows high privileged attacker with lo…
cve-program ·
Vendor product: Siebel CRM Cloud Applications
CVE-2026-83080Published
Vulnerability in the Oracle Banking Branch product of Oracle Financial Services Applications (component: Reports). Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged att…
cve-program ·
Vendor product: Oracle Banking Branch
CVE-2026-83081Published
Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications (component: Core). Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows unauthenti…
cve-program ·
Vendor product: Oracle Banking Corporate Lending
CVE-2026-83082Published
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access v…
cve-program ·
Vendor product: Oracle Marketing
CVE-2026-83086Published
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Easily exploitable vulnerability allows low privileged attacker with net…
cve-program ·
Vendor product: Siebel CRM Cloud Applications
CVE-2026-83087Published
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.7. Difficult to exploit vulnerability allows low privileged attacker with n…
cve-program ·
Vendor product: Siebel CRM Cloud Applications
CVE-2026-83089Published
Vulnerability in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network ac…
cve-program ·
Vendor product: Oracle Alert
CVE-2026-83090Published
Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wit…
cve-program ·
Vendor product: Oracle Spares Management
CVE-2026-83092Published
Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with …
cve-program ·
Vendor product: Oracle Field Service
CVE-2026-83096Published
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privilege…
cve-program ·
Vendor product: Oracle Forms
CVE-2026-79752Published
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
cve-program ·
Vendor product: cakephp
CVE-2026-83101Published
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticat…
cve-program ·
Vendor product: Oracle Forms
CVE-2026-83102Published
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticat…
cve-program ·
Vendor product: Oracle Forms
CVE-2026-83103Published
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged…
cve-program ·
Vendor product: Oracle Forms
CVE-2026-54471Published
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to …
cve-program ·
Vendor product: SmartFabric Manager
CVE-2026-83105Published
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticat…
cve-program ·
Vendor product: Oracle Forms
CVE-2026-83106Published
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privilege…
cve-program ·
Vendor product: Oracle Forms
CVE-2026-83107Published
Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged…
cve-program ·
Vendor product: Oracle Forms
CVE-2026-83122Published
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with n…
cve-program ·
Vendor product: Oracle Report Manager
CVE-2026-83124Published
Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with net…
cve-program ·
Vendor product: Oracle Sales Online
CVE-2026-83125Published
Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with n…
cve-program ·
Vendor product: Oracle Report Manager
CVE-2026-83132Published
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access …
cve-program ·
Vendor product: Oracle iStore
CVE-2026-83134Published
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access …
cve-program ·
Vendor product: Oracle iStore
CVE-2026-83135Published
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access …
cve-program ·
Vendor product: Oracle iStore
CVE-2026-83136Published
Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wit…
cve-program ·
Vendor product: Oracle Spares Management
CVE-2026-83137Published
Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wit…
cve-program ·
Vendor product: Oracle Spares Management
CVE-2026-83138Published
Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker …
cve-program ·
Vendor product: Oracle Spares Management
CVE-2026-83140Published
Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with ne…
cve-program ·
Vendor product: Oracle Field Service
CVE-2026-83141Published
Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with ne…
cve-program ·
Vendor product: Oracle Field Service
CVE-2026-83142Published
Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…
cve-program ·
Vendor product: Oracle Proposals
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.