CVE-2026-13265Published
IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection
cve-program ·
Vendor product: MQ
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699698 source statements · aliases may refer to the same vulnerabilityCVE-2026-12759Published
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
cve-program ·
Vendor product: Cloud Pak for Business Automation
CVE-2026-12758Published
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
cve-program ·
Vendor product: Cloud Pak for Business Automation
CVE-2026-88261Published
Improper input validation vulnerability in bizwell xClick allows Stored XSS.
cve-program ·
Vendor product: xClick
CVE-2026-87791Published
Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme
cve-program ·
Vendor product: design-scuole-wordpress-theme
CVE-2026-87792Published
Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme
cve-program ·
Vendor product: design-scuole-wordpress-theme
CVE-2026-87793Published
Reflected XSS in WordPress theme design-scuole-wordpress-theme
cve-program ·
Vendor product: design-scuole-wordpress-theme
CVE-2026-89307Published
HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme
cve-program ·
Vendor product: design-scuole-wordpress-theme
CVE-2026-12358Published
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
cve-program ·
Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container
CVE-2023-54398Published
Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet
cve-program ·
Vendor product: U8 Cloud
CVE-2026-59160Published
Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run
cve-program ·
Vendor product: yeger
CVE-2026-54561Published
MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath
cve-program ·
Vendor product: mcp-memory-keeper
CVE-2026-90622Published
GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference
cve-program ·
Vendor product: libredwg
CVE-2026-91853Published
TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection
cve-program ·
Vendor product: X5000R
CVE-2026-58196Published
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
cve-program ·
Vendor product: toolhive
CVE-2026-55774Published
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808
cve-program ·
Vendor product: openbao
CVE-2026-90703Published
D-Link DWR-M921 formDiskCreateShare system os command injection
cve-program ·
Vendor product: DWR-M921
CVE-2026-90617Published
GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection
cve-program ·
Vendor product: PentestAgent
CVE-2026-55591Published
Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints
cve-program ·
Vendor product: signalk-server
CVE-2026-13277Published
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
cve-program ·
Vendor product: Verify Identity Access · Vendor product: Security Verify Access · Vendor product: Verify Identity Access Container
CVE-2026-90683Published
GPAC MP4Box base_scenegraph.c gf_node_unregister assertion
cve-program ·
Vendor product: GPAC
CVE-2026-90679Published
Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an inc…
cve-program ·
Vendor product: Forgejo
CVE-2026-90491Published
sanjevirau gsubs Electron index.js showQuerySuccessPage code injection
cve-program ·
Vendor product: gsubs
CVE-2026-91848Published
WuzhiCMS index.php getDataOfJson sql injection
cve-program ·
Vendor product: WuzhiCMS
CVE-2026-52296Published
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
cve-program ·
Vendor product: FFmpeg
CVE-2026-36989Published
A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.
cve-program ·
Vendor product: LuxCal Web Calendar
CVE-2026-54076Published
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
cve-program ·
Vendor product: arcadedb · Vendor product: arcadedb-engine
CVE-2025-70820Published
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.
cve-program ·
Vendor product: D6 Ultra
CVE-2026-90486Published
openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery
cve-program ·
Vendor product: openstatus
CVE-2026-90647Published
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certif…
cve-program ·
Vendor product: ASE2000 V2 Communication Test Set
CVE-2026-65353Published
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6. An app may be able to access sensitive user data.
cve-program ·
Vendor product: iOS and iPadOS · Vendor product: macOS
CVE-2024-14029Published
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
cve-program ·
Vendor product: tornado
CVE-2026-90557Published
Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame
cve-program ·
Vendor product: freeciv
CVE-2026-90552Published
WWBN AVideo Missing Authorization via Playlists_schedules list.json.php
cve-program ·
Vendor product: AVideo
CVE-2026-90547Published
WWBN AVideo Missing Authorization via getBookmarks.json.php
cve-program ·
Vendor product: AVideo
CVE-2026-76443Published
Cisco Secure Email Gateway Security Hardening Release
cve-program ·
Vendor product: Cisco Secure Email · Vendor product: Cisco Secure Email and Web Manager
CVE-2026-20353Published
Cisco Secure Email Gateway Security Hardening Release
cve-program ·
Vendor product: Cisco Secure Email
CVE-2026-76441Published
Cisco Secure Email Gateway Security Hardening Release
cve-program ·
Vendor product: Cisco Secure Email and Web Manager
CVE-2026-76440Published
Cisco Secure Email Gateway Security Hardening Release
cve-program ·
Vendor product: Cisco Secure Email · Vendor product: Cisco Secure Email and Web Manager
CVE-2026-90542Published
WWBN AVideo Missing Authorization via remindMe.json.php
cve-program ·
Vendor product: AVideo
CVE-2026-91937Published
Flowise before 3.1.4 NoSQL Injection via sessionId
cve-program ·
Vendor product: Flowise
CVE-2026-90537Published
WWBN AVideo Scheduler sendEmail Missing Authorization via Token
cve-program ·
Vendor product: AVideo
CVE-2026-89267Published
starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass
cve-program ·
Vendor product: starlette-admin
CVE-2026-54724Published
Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint
cve-program ·
Vendor product: Kiwi
CVE-2026-54258Published
Cross-monitor event media authorization bypass in direct event media endpoints
cve-program ·
Vendor product: zoneminder
CVE-2026-49846Published
libks has path traversal in kws HTTP parser via URI segment overflow
cve-program ·
Vendor product: libks
CVE-2026-44715Published
OpenMRS has Broken Access Control in HL7 Configuration
cve-program ·
Vendor product: org.openmrs.module:legacyui-api
CVE-2026-47773Published
ArduinoBLE: Memory corruption via malformed ATT write request
cve-program ·
Vendor product: ArduinoBLE
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.