CVE-2026-92213Published
a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection
cve-program ·
Vendor product: a2ui
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699329 source statements · aliases may refer to the same vulnerabilityCVE-2026-92215Published
a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery
cve-program ·
Vendor product: a2ui
CVE-2026-86043Published
Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)
cve-program ·
Vendor product: skipper
CVE-2026-15640Published
Authentication Bypass via SAML Response Manipulation
cve-program ·
Vendor product: Secret Server (On-Prem)
CVE-2026-15639Published
Reflected Cross-Site Scripting
cve-program ·
Vendor product: Secret Server (On-Prem)
CVE-2026-15638Published
Cryptographic Padding Oracle
cve-program ·
Vendor product: Secret Server (On-Prem)
CVE-2026-90563Published
maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting
cve-program ·
Vendor product: bbs-springboot
CVE-2026-92397Published
Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection
cve-program ·
Vendor product: RG-EW3000GX
CVE-2026-92256Published
Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers
cve-program ·
Vendor product: NR255-V
CVE-2026-76870Published
Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write Firmware Upload Validation
cve-program ·
Vendor product: NR255-V
CVE-2026-76865Published
Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers
cve-program ·
Vendor product: NR255-V
CVE-2026-76860Published
Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID Tokenization
cve-program ·
Vendor product: NR255-V
CVE-2026-76855Published
Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints
cve-program ·
Vendor product: NR255-V
CVE-2026-92366Published
code-projects Matrimonial System Regular Search search.php sql injection
cve-program ·
Vendor product: Matrimonial System
CVE-2026-76820Published
OpenCTI: Synchronizer SSRF: stream fetch has no URL validation
cve-program ·
Vendor product: opencti
CVE-2026-83368Published
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM…
cve-program ·
Vendor product: Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM
CVE-2026-92405Published
SourceCodester Inventory and Monitoring System index.php sql injection
cve-program ·
Vendor product: Inventory and Monitoring System
CVE-2026-54544Published
Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints
cve-program ·
Vendor product: fireshare
CVE-2026-92418Published
ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting
cve-program ·
Vendor product: crm
CVE-2026-92247Published
synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload
cve-program ·
Vendor product: synaptik-cms
CVE-2026-92361Published
ag-ui-protocol ag-ui SSE Client client.go resource consumption
cve-program ·
Vendor product: ag-ui
CVE-2026-92114Published
a2ui-project a2ui Basic Catalog safe_regex.ts redos
cve-program ·
Vendor product: a2ui
CVE-2026-92133Published
Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials ar…
cve-program ·
Vendor product: Jenkins GitLab Plugin
CVE-2026-92134Published
Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: schem…
cve-program ·
Vendor product: Jenkins Warnings Plugin
CVE-2026-92135Published
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL…
cve-program ·
Vendor product: Jenkins Coverage Plugin
CVE-2026-92136Published
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure …
cve-program ·
Vendor product: Jenkins OWASP Dependency-Check Plugin
CVE-2026-76853Published
Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi
cve-program ·
Vendor product: NR268
CVE-2026-92137Published
Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure…
cve-program ·
Vendor product: Jenkins Robot Framework Plugin
CVE-2026-27550Published
Command Injection in Field_Shadow_Password Class
cve-program ·
Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45
CVE-2026-76858Published
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi
cve-program ·
Vendor product: NR255-V
CVE-2026-27555Published
Local File Inclusion in /index.php/ajax/get_iodd_port_info
cve-program ·
Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45
CVE-2026-27560Published
Command Injection via DELETE in /api/status/data
cve-program ·
Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45
CVE-2026-76863Published
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes
cve-program ·
Vendor product: NR255-V
CVE-2026-27565Published
Remote code execution via uploading a malicious IODD file
cve-program ·
Vendor product: ICE2-8IOL1-G65L-V1D · Vendor product: ICE2-8IOL-G65L-V1D · Vendor product: ICE2-8IOL-K45P-RJ45
CVE-2026-76868Published
Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route_policy_add.cgi via Missing exit_port
cve-program ·
Vendor product: NR255-V
CVE-2026-76873Published
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields
cve-program ·
Vendor product: NR255-V
CVE-2026-92216Published
a2ui-project a2ui Binder generic-binder.ts openUrl redirect
cve-program ·
Vendor product: a2ui
GHSA-v56q-mh7h-f735Published
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
osv · CVE-2026-59879
npm: immutable · npm: immutable · npm: immutable
GHSA-4qpv-39hg-f7fxPublished
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
osv · CVE-2026-59965
npm: @jhb.software/payload-alt-text-plugin
CVE-2026-15402Published
Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
cve-program ·
Vendor product: Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
CVE-2026-15609Published
Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
cve-program ·
Vendor product: Bridge - Creative Multipurpose WordPress Theme
CVE-2026-14349Published
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
cve-program ·
Vendor product: TrueBooker – Appointment Booking and Scheduler System
CVE-2026-5920Published
Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
cve-program ·
Vendor product: Bold Page Builder
CVE-2026-92299Published
@jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture
cve-program ·
Vendor product: @jitsi/electron-sdk
CVE-2026-78088Published
Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
cve-program ·
Vendor product: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
CVE-2026-69209Published
Http4s: WebSocket decoder accepts unbounded message sizes
cve-program ·
Vendor product: http4s
CVE-2026-69147Published
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation
cve-program ·
Vendor product: vllm
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.