CVE-2026-82427Published
Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.storm:storm-server
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699754 source statements · aliases may refer to the same vulnerabilityCVE-2026-48496Published
opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
cve-program ·
Vendor product: opentelemetry-ebpf-profiler
CVE-2026-82435Published
Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.storm:storm-client
CVE-2026-82437Published
Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.storm:storm-webapp
CVE-2026-82426Published
Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location
cve-program ·
https://repo.maven.apache.org/maven2/: org.apache.storm:storm-server
CVE-2026-82438Published
Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.storm:storm-webapp
CVE-2025-10938Published
UiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
cve-program ·
Vendor product: UiPress lite | Effortless custom dashboards, admin themes and pages
CVE-2026-82439Published
Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.storm:storm-server
CVE-2026-82434Published
Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.storm:storm-server · https://repo.maven.apache.org/maven2: org.apache.storm:storm-client
CVE-2026-84179Published
Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.storm:storm-server · https://repo.maven.apache.org/maven2: org.apache.storm:storm-webapp
CVE-2026-82232Published
Apache Syncope: SQL injection via sort parameter in Task search
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-persistence-jpa
CVE-2026-86460Published
Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-persistence-neo4j
CVE-2026-87779Published
Apache Syncope: AES Secret Key disclosure via log output
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-spring
CVE-2026-87785Published
Apache Syncope: JWT subject spoofing
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-spring
CVE-2026-82441Published
Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.storm:storm-server
CVE-2026-19624Published
NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
cve-program ·
https://github.com/nm-l2tp/NetworkManager-l2tp: NetworkManager-l2tp · https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp: NetworkManager-l2tp · https://bodhi.fedoraproject.org/updates/?packages=NetworkManager-l2tp: NetworkManager-l2tp
CVE-2026-19542Published
Stack-based out-of-bounds write in tdelete during tree rebalancing
cve-program ·
Vendor product: glibc
CVE-2026-19499Published
Buffer overflow in strfmon and strfmon_l right-justification padding
cve-program ·
Vendor product: glibc
CVE-2026-87802Published
Apache Syncope: SRA OAuth2 JWT signature verification bypass
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope:syncope-sra
CVE-2026-68570Published
Apache Doris: Authorization bypass leading to unauthorized data access
cve-program ·
Vendor product: Apache Doris
CVE-2026-72524Published
Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
cve-program ·
Vendor product: Apache Doris
CVE-2026-11993Published
Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion
cve-program ·
Vendor product: Mattermost
CVE-2026-14259Published
Board archive import bypasses team board creation permissions
cve-program ·
Vendor product: Mattermost
CVE-2026-85125Published
The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites…
cve-program ·
Vendor product: YAMAP -Social Trekking GPS App
CVE-2026-82796Published
SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
cve-program ·
Vendor product: SV-CPT-MC310 · Vendor product: SV-CPT-MC310F
CVE-2026-90813Published
cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize
cve-program ·
Vendor product: mercury-agent
CVE-2026-85583Published
SiYuan before v3.8.2 Path Traversal via symlink in file API
cve-program ·
Vendor product: siyuan
CVE-2026-85598Published
Grav 2.0.0 through 2.0.17 Stored XSS via Modular Pages
cve-program ·
Vendor product: grav
CVE-2026-85603Published
Grav Admin Plugin Path Traversal via Save As Language Code
cve-program ·
Vendor product: grav
CVE-2026-85617Published
snipe-it before 8.6.3 Authorization Bypass via Bulk Delete
cve-program ·
Vendor product: snipe-it
CVE-2026-85606Published
firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath
cve-program ·
Vendor product: firecrawl-mcp-server
CVE-2026-85620Published
Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function
cve-program ·
Vendor product: postgres-mcp
CVE-2026-85625Published
sift 17.1.3 Prototype Pollution Remote Code Execution via $where
cve-program ·
Vendor product: sift.js
CVE-2026-85661Published
excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode
cve-program ·
Vendor product: excel-mcp-server
CVE-2026-85666Published
ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url
cve-program ·
Vendor product: ogx
CVE-2026-85671Published
QAnything 2.0.0 Unauthenticated Cross-User File Disclosure
cve-program ·
Vendor product: QAnything
CVE-2026-85676Published
Dub Open Redirect via Unrestricted redir_url Parameter
cve-program ·
Vendor product: dub
CVE-2026-85688Published
TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer
cve-program ·
Vendor product: ten-framework
CVE-2026-85693Published
Chatbot UI Cross-User Private File Content Disclosure via Retrieval API
cve-program ·
Vendor product: chatbot-ui
CVE-2026-85698Published
Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service
cve-program ·
Vendor product: turso
CVE-2026-86090Published
ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
cve-program ·
Vendor product: ntopng
CVE-2026-86098Published
ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape
cve-program ·
https://github.com/ntop/nDPI: nDPI
CVE-2026-86714Published
PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman
cve-program ·
https://github.com/PX4/PX4-Autopilot: PX4-Autopilot
CVE-2026-73191Published
Apache Syncope: CAS service URL injection via Forwarded HTTP headers
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope:syncope-sra
CVE-2026-73236Published
Apache Syncope: Cross-Realm authorization bypass in delegated administration
cve-program ·
Vendor product: Apache Syncope
CVE-2026-73370Published
Apache Syncope: Cross-Realm boundaries reconciliation bypass
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core.idm:syncope-core-idm-logic
CVE-2026-73178Published
Apache Syncope: JWT Access Token takeover
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-provisioning-java
CVE-2026-73470Published
Apache Syncope: Delegating users can grant unowned Roles
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-provisioning-java
CVE-2026-50018Published
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
cve-program ·
Vendor product: hoverfly
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.