CVE-2026-76440Published
Cisco Secure Email Gateway Security Hardening Release
cve-program ·
Vendor product: Cisco Secure Email · Vendor product: Cisco Secure Email and Web Manager
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699709 source statements · aliases may refer to the same vulnerabilityCVE-2026-90542Published
WWBN AVideo Missing Authorization via remindMe.json.php
cve-program ·
Vendor product: AVideo
CVE-2026-91937Published
Flowise before 3.1.4 NoSQL Injection via sessionId
cve-program ·
Vendor product: Flowise
CVE-2026-90537Published
WWBN AVideo Scheduler sendEmail Missing Authorization via Token
cve-program ·
Vendor product: AVideo
CVE-2026-89267Published
starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass
cve-program ·
Vendor product: starlette-admin
CVE-2026-54724Published
Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint
cve-program ·
Vendor product: Kiwi
CVE-2026-54258Published
Cross-monitor event media authorization bypass in direct event media endpoints
cve-program ·
Vendor product: zoneminder
CVE-2026-49846Published
libks has path traversal in kws HTTP parser via URI segment overflow
cve-program ·
Vendor product: libks
CVE-2026-44715Published
OpenMRS has Broken Access Control in HL7 Configuration
cve-program ·
Vendor product: org.openmrs.module:legacyui-api
CVE-2026-47773Published
ArduinoBLE: Memory corruption via malformed ATT write request
cve-program ·
Vendor product: ArduinoBLE
CVE-2026-49464Published
NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak
cve-program ·
Vendor product: nl-portal-backend-libraries
CVE-2026-54072Published
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
cve-program ·
Vendor product: authorizer
CVE-2026-17133Published
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
cve-program ·
Vendor product: App Connect Enterprise
CVE-2026-17416Published
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
cve-program ·
Vendor product: App Connect Enterprise
MAL-2026-16188Published
Malicious code in strapi-plugin-rs-meeb322k (npm)
osv ·
npm: strapi-plugin-rs-meeb322k
MAL-2026-16191Published
Malicious code in strapi-plugin-uicc-meeb (npm)
osv ·
npm: strapi-plugin-uicc-meeb
MAL-2026-16183Published
Malicious code in strapi-plugin-resh-meeb322k (npm)
osv ·
npm: strapi-plugin-resh-meeb322k
MAL-2026-16186Published
Malicious code in strapi-plugin-revs02-meeb322k (npm)
osv ·
npm: strapi-plugin-revs02-meeb322k
MAL-2026-16185Published
Malicious code in strapi-plugin-revs01-meeb322k (npm)
osv ·
npm: strapi-plugin-revs01-meeb322k
MAL-2026-16184Published
Malicious code in strapi-plugin-revs-meeb322k (npm)
osv ·
npm: strapi-plugin-revs-meeb322k
MAL-2026-16189Published
Malicious code in strapi-plugin-sucresh-meeb (npm)
osv ·
npm: strapi-plugin-sucresh-meeb
MAL-2026-16187Published
Malicious code in strapi-plugin-revsh-meeb322k (npm)
osv ·
npm: strapi-plugin-revsh-meeb322k
MAL-2026-16190Published
Malicious code in strapi-plugin-tryccresh-meeb (npm)
osv ·
npm: strapi-plugin-tryccresh-meeb
MAL-2026-16182Published
Malicious code in strapi-plugin-proccresh-meeb (npm)
osv ·
npm: strapi-plugin-proccresh-meeb
MAL-2026-16180Published
Malicious code in strapi-plugin-ccresh-meeb (npm)
osv ·
npm: strapi-plugin-ccresh-meeb
MAL-2026-16181Published
Malicious code in strapi-plugin-plsresh-meeb (npm)
osv ·
npm: strapi-plugin-plsresh-meeb
MAL-2026-16161Published
Malicious code in meraz-project-tracker (npm)
osv · GHSA-54v8-j59m-366h
npm: meraz-project-tracker
MAL-2026-16192Published
Malicious code in strapi-plugin-weccresh-meeb (npm)
osv ·
npm: strapi-plugin-weccresh-meeb
MAL-2026-16194Published
Malicious code in strapi-plugin-yesccresh-meeb (npm)
osv ·
npm: strapi-plugin-yesccresh-meeb
MAL-2026-16193Published
Malicious code in strapi-plugin-yayccresh-meeb (npm)
osv ·
npm: strapi-plugin-yayccresh-meeb
MAL-2026-16174Published
Malicious code in alkajsdfoiwqeusdflkjsdf (npm)
osv ·
npm: alkajsdfoiwqeusdflkjsdf
CVE-2026-89257Published
AVideo through 29.0 Cross-User Category Asset Deletion via Missing Ownership Check
cve-program ·
Vendor product: AVideo
CVE-2026-54450Published
ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
cve-program ·
Vendor product: toolhive
CVE-2026-89252Published
AVideo Missing Authorization in addLiveLink.php LiveLink Update
cve-program ·
Vendor product: AVideo
CVE-2026-89247Published
WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php
cve-program ·
Vendor product: AVideo
CVE-2026-89242Published
WWBN AVideo Unauthenticated SSRF via login.json.php
cve-program ·
Vendor product: AVideo
CVE-2026-91932Published
Flowise before 3.1.4 Remote Code Execution via cwd Parameter
cve-program ·
Vendor product: Flowise · Vendor product: Flowise
CVE-2026-44282Published
Election question titles allow stored script execution
cve-program ·
Vendor product: decidim
CVE-2026-91990Published
Tornado before 6.5.8 Memory Amplification DoS via multipart
cve-program ·
Vendor product: tornado
CVE-2026-91943Published
Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy
cve-program ·
Vendor product: crawl4ai
CVE-2026-91985Published
Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
cve-program ·
Vendor product: vikunja
CVE-2026-91980Published
vikunja before 2.6.0 Team Enumeration via Project Share
cve-program ·
Vendor product: vikunja
CVE-2026-91970Published
Vikunja before 2.6.0 Resource Exhaustion via Planka Migration
cve-program ·
Vendor product: vikunja
CVE-2026-91953Published
FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO
cve-program ·
Vendor product: FreeRDP
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.