Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699709 source statements · aliases may refer to the same vulnerabilityImproper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane (NETCONF) may execute arbitrary OS commands.
cve-program ·
Vendor product: FF-RFI079I4 · Vendor product: FF-RFI078I4
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison
cve-program ·
Vendor product: MISP
IBM Sterling File Gateway is Vulnerable to Improper Access Control
cve-program ·
Vendor product: Sterling File Gateway
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
cve-program ·
Vendor product: Plesk extension "Ruby" · Vendor product: Plesk extension "Node.js Toolkit"
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
cve-program ·
Vendor product: WHMCS
Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands.
cve-program ·
Vendor product: FF-RFI079I4 · Vendor product: FF-RFI078I4
MISP: State-changing actions accessible via GET request enabling CSRF
cve-program ·
Vendor product: MISP
MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass
cve-program ·
Vendor product: MISP
OpenAM Insecure SSO Cookie Initialization
cve-program ·
Vendor product: OpenAM
OpenAM Arbitrary OAuth Token Minting via Push Registration
cve-program ·
Vendor product: OpenAM
OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution
cve-program ·
Vendor product: WSO2 Integrator: MI for Visual Studio Code
Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
cve-program ·
Vendor product: WSO2 API Manager · Vendor product: WSO2 API Control Plane · Vendor product: WSO2 Universal Gateway
OpenAM Authenticated RCE via Groovy Sandbox Escape
cve-program ·
Vendor product: OpenAM
PraisonAI AgentLoop onToolCall approval runs after tool execution
cve-program ·
Vendor product: PraisonAI
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
osv · CVE-2026-39830 · GO-2026-5017
Go: golang.org/x/crypto
PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
cve-program ·
Vendor product: PraisonAI
Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query_builder OR-bypass
cve-program ·
Vendor product: kimai
OpenAM LDAP Injection via `_queryId` Parameter
cve-program ·
Vendor product: OpenAM
Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation
cve-program ·
Vendor product: kimai
PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
cve-program ·
Vendor product: PraisonAI
PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
cve-program ·
Vendor product: PraisonAI
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
cve-program ·
Vendor product: fast-uri
Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility
cve-program ·
Vendor product: kimai
MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion
cve-program ·
Vendor product: MISP
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
cve-program ·
Vendor product: fast-uri
Arbitrary command execution in TrxTimeATTENDANCE
cve-program ·
Vendor product: TrxTimeATTENDANCE
Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
cve-program ·
Vendor product: kimai
SHIFT_JISX0213 decoding may hang on crafted input
cve-program ·
Vendor product: glibc
EUC_JISX0213 decoding may hang on crafted input
cve-program ·
Vendor product: glibc
Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation.
cve-program ·
Vendor product: GateManager
MISP: Authentication failure logging suppressed during Redis unavailability
cve-program ·
Vendor product: MISP
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
cve-program ·
https://pkg.go.dev: golang.org/x/crypto/ssh/knownhosts
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
cve-program ·
Vendor product: netty
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
cve-program ·
Vendor product: netty
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
cve-program ·
https://pkg.go.dev: golang.org/x/crypto/ssh/agent
c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property
cve-program ·
Vendor product: c3p0
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
cve-program ·
Vendor product: mchange-commons-java
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper
osv · CVE-2026-65838 · GHSA-8qqm-fp2q-v734
Go: github.com/zalando/skipper
Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability
cve-program ·
https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator
Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh
osv · CVE-2026-39829 · GHSA-w879-237q-wc7r
Go: golang.org/x/crypto
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
osv · CVE-2026-39832 · GHSA-f5wc-c3c7-36mc
Go: golang.org/x/crypto
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
osv · CVE-2026-42508 · GHSA-5cgq-3rg8-m6cv
Go: golang.org/x/crypto
Parallels Desktop local privilege escalation via appliance extract argument injection
cve-program ·
Vendor product: Parallels Desktop
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictable path derived from the agent name and a hash of the workload's runtime configuration. If a direct…
cve-program ·
Vendor product: Eclipse Ankaios
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.