CVE-2026-55770Published
OpenBao: LDAPi ldaputil (wrong escape func)
cve-program ·
Vendor product: openbao
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699329 source statements · aliases may refer to the same vulnerabilityCVE-2026-21586Published
This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center.
cve-program ·
Vendor product: Confluence Data Center
CVE-2026-21587Published
This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center.
cve-program ·
Vendor product: Jira Service Management Data Center
CVE-2026-81240Published
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Re…
cve-program ·
Vendor product: Wyse Management Suite
CVE-2026-73465Published
On affected platforms running Arista EOS, under certain circumstances plaintext private keys
cve-program ·
Vendor product: EOS
GHSA-2x7j-588g-ccc2Published
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
osv · CVE-2026-92596
npm: nodemailer
GHSA-cc9r-2j5m-2m83Published
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
osv · CVE-2026-92597
npm: nodemailer
GHSA-8m3c-c648-2xjjPublished
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
osv · CVE-2026-92595
npm: nodemailer
GHSA-wmmp-3585-3rmpPublished
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
osv · CVE-2026-92598
npm: nodemailer
CVE-2026-73447Published
Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request
cve-program ·
Vendor product: EOS
CVE-2026-86358Published
Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execut…
cve-program ·
Vendor product: Update Package Framework
CVE-2026-91843Published
Stack overflow in login process to the Security Management and Log Servers
cve-program ·
Vendor product: Quantum Security Management
CVE-2026-71180Published
Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
cve-program ·
Vendor product: Update Package Framework
CVE-2026-86359Published
Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
cve-program ·
Vendor product: Repository Manager
CVE-2026-20307Published
Cisco Identity Services Engine Remote Code Execution Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software
CVE-2026-76420Published
Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Management Center (FMC)
CVE-2026-20234Published
Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities
cve-program ·
Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector
CVE-2026-91098Published
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
cve-program ·
Vendor product: HP Linux Imaging and Printing Software (HPLIP)
CVE-2026-91104Published
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
cve-program ·
Vendor product: HP Linux Imaging and Printing Software (HPLIP)
CVE-2026-91105Published
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
cve-program ·
Vendor product: HP Linux Imaging and Printing Software (HPLIP)
CVE-2026-91106Published
HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities
cve-program ·
Vendor product: HP Linux Imaging and Printing Software (HPLIP)
CVE-2026-20211Published
Cisco Identity Services Engine Remote Code Execution Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software
CVE-2026-76423Published
Cisco ISE API Authentication Bypass Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector
CVE-2026-20176Published
Cisco Identity Services Engine Remote Code Execution Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software
CVE-2026-76424Published
Cisco ISE Arbitrary File Access Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software
CVE-2026-20283Published
Cisco Identity Services Engine IPSec Open API Command Injection Vulnerability
cve-program ·
Vendor product: Cisco Identity Services Engine Software
CVE-2026-76412Published
Cisco Secure Firewall Management Center Software Authenticated Privilege Escalation to Root Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Management Center (FMC)
CVE-2026-20323Published
Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Unauthorized Authentication Bypass Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Management Center (FMC) · Vendor product: Cisco Secure Firewall Threat Defense (FTD) Software
CVE-2026-20287Published
Cisco Identity Services Engine Hardening Release - Improper Privlege Management Vulnerabilities
cve-program ·
Vendor product: Cisco Identity Services Engine Software · Vendor product: Cisco ISE Passive Identity Connector
GO-2026-5019Published
Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
osv · CVE-2026-39831 · GHSA-89gr-r52h-f8rx
Go: golang.org/x/crypto
GO-2026-5013Published
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
osv · CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
Go: golang.org/x/crypto
CVE-2026-75811Published
Improper Restriction of Software Interfaces to Hardware Features in ASUS Armoury Crate allows a local user to modify hardware configuration settings and potentially cause hardware damage by bypassing driver authentication and accessing crit…
cve-program ·
Vendor product: Armoury Crate
CVE-2026-75810Published
Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a brief system stall by bypassing driver authentication and sending requests to trigger system management interrupts (SMIs). Repeatedly triggering SMI ma…
cve-program ·
Vendor product: Armoury Crate
CVE-2026-75809Published
Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configu…
cve-program ·
Vendor product: Armoury Crate
CVE-2026-75808Published
Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to cause a denial-of-service condition through system memory exhaustion by bypassing driver authentication and allocating an unrestricted amount …
cve-program ·
Vendor product: Armoury Crate
CVE-2026-75754Published
Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service …
cve-program ·
Vendor product: Control Center Enterprise (ACC)
CVE-2026-19397Published
Missing authentication for a critical function in ASUS Control Center Express Agent allows an unauthenticated nearby user to control the host via a direct connection to the agent when the host has an active login session.
cve-program ·
Vendor product: Control Center Express Agent
CVE-2026-18023Published
Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verifica…
cve-program ·
Vendor product: Armoury Crate
CVE-2026-16006Published
Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially provid…
cve-program ·
Vendor product: Armoury Crate
CVE-2026-16005Published
Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (BSO…
cve-program ·
Vendor product: Armoury Crate
MAL-2026-16249Published
Malicious code in kartykgithub-takedown-b (npm)
osv · GHSA-f8wr-9w83-7gmw
npm: kartykgithub-takedown-b
CVE-2026-16003Published
Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request by bypassing the driver's verification.Refer to the '
cve-program ·
Vendor product: Armoury Crate
CVE-2026-15030Published
Out-of-bounds Read in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by supplying a crafted IOCTL request …
cve-program ·
Vendor product: System Control Interface v3 · Vendor product: System Control Interface · Vendor product: Business Manager
CVE-2026-15029Published
Untrusted Pointer Dereference in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to perform arbitrary physical memory read and write operations via crafted IOCTL reques…
cve-program ·
Vendor product: System Control Interface v3 · Vendor product: System Control Interface · Vendor product: Business Manager
CVE-2026-13585Published
Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive inf…
cve-program ·
Vendor product: System Control Interface v3 · Vendor product: System Control Interface · Vendor product: Business Manager
CVE-2026-12962Published
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by convincing the user to visit a crafted web page that sends a request containing a UNC path to the a…
cve-program ·
Vendor product: Armoury Crate
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.