CVE-2026-73579Published
Apache Syncope: Non-recursive Any search could skip Realms restrictions
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-persistence-common
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699754 source statements · aliases may refer to the same vulnerabilityCVE-2026-75015Published
Apache Syncope: Nested secrets leak cleartext into audit records readable
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-provisioning-java
CVE-2026-75030Published
Apache Syncope: Incomplete authorization checks for Group members deprovisioning
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core.idrepo:syncope-core-idrepo-logic
CVE-2026-77051Published
Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-persistence-jpa
CVE-2026-78299Published
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on dis…
cve-program ·
Vendor product: Eclipse Embedded CDT (C/C++ Development Tools)
CVE-2026-85200Published
GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
cve-program ·
Vendor product: GEO my WP
CVE-2026-78006Published
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
cve-program ·
Vendor product: The Events Calendar
CVE-2026-77161Published
Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
cve-program ·
Vendor product: Smart Marketing SMS and Newsletters Forms
CVE-2026-10148Published
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
cve-program ·
Vendor product: Booking for Appointments and Events Calendar – Amelia
CVE-2026-86349Published
Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
cve-program ·
Vendor product: Mattermost
CVE-2026-86348Published
MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
cve-program ·
Vendor product: Mattermost
CVE-2026-82920Published
Mattermost ABAC parent policy bypass via policy update endpoint
cve-program ·
Vendor product: Mattermost
CVE-2026-7848Published
SQL Injection in Alior Bank raty PrestaShop module
cve-program ·
Vendor product: raty
CVE-2026-15600Published
SQL Injection in Alior Bank raty PrestaShop module
cve-program ·
Vendor product: raty
CVE-2026-88819Published
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
cve-program ·
Vendor product: Eclipse Data Plane Core
CVE-2026-81301Published
Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access
cve-program ·
Vendor product: File Manager
CVE-2026-4103Published
Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution
cve-program ·
Vendor product: WSO2 API Control Plane · Vendor product: WSO2 API Manager
CVE-2026-19543Published
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
cve-program ·
Vendor product: Common Licensing
CVE-2026-18515Published
IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
cve-program ·
Vendor product: i
CVE-2026-78336Published
Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic
CVE-2026-78330Published
Apache Syncope: Privilege escalation for admin user via JWT authentication
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-spring
CVE-2026-61534Published
Yayson: Prototype pollution in the Store/LegacyStore deserialization
cve-program ·
Vendor product: yayson
CVE-2026-57125Published
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
cve-program ·
Vendor product: PraisonAI · Vendor product: praisonaiagents
CVE-2026-78318Published
Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui
CVE-2026-50270Published
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
cve-program ·
Vendor product: dd-trace-java · Vendor product: dd-java-agent
CVE-2026-77883Published
Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-provisioning-api
CVE-2026-77181Published
Apache Syncope: ClientApp update entitlement not effective
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core.am:syncope-core-am-logic
CVE-2026-57126Published
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
cve-program ·
Vendor product: PraisonAI
CVE-2026-73668Published
Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core.idm:syncope-core-idm-logic
CVE-2026-90808Published
HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
cve-program ·
Vendor product: nanobot
CVE-2026-65919Published
Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload
cve-program ·
Vendor product: meshery
CVE-2026-82035Published
PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
cve-program ·
Vendor product: PyMuPDF
CVE-2026-54176Published
backpack/crud: MyAccountController allows changing the login email without a current-password check
cve-program ·
Vendor product: CRUD
CVE-2026-18151Published
IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
cve-program ·
Vendor product: i
CVE-2026-57583Published
OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source
cve-program ·
Vendor product: contracts-wizard · Vendor product: wizard · Vendor product: wizard-cairo
CVE-2026-57578Published
DotVVM: Missing authorization in AuthorizeActionFilter
cve-program ·
Vendor product: dotvvm
CVE-2026-53659Published
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
cve-program ·
Vendor product: http4k
CVE-2026-54150Published
next-video: Unauthenticated arbitrary file read via /api/video request handler
cve-program ·
Vendor product: next-video
CVE-2026-57124Published
PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
cve-program ·
Vendor product: PraisonAI
CVE-2026-49250Published
Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields
cve-program ·
Vendor product: conform
CVE-2026-59178Published
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
cve-program ·
Vendor product: device-builder
CVE-2025-24890Published
gix-sec safe.directory protections absent for elevated administrators
cve-program ·
Vendor product: gitoxide
CVE-2026-90811Published
cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure
cve-program ·
Vendor product: mercury-agent
CVE-2026-54087Published
EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
cve-program ·
Vendor product: EasyAdminBundle
CVE-2026-70658Published
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
cve-program ·
Vendor product: pay
CVE-2026-34151Published
XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+
cve-program ·
Vendor product: xwiki-platform
CVE-2026-81823Published
AVEVA Pipeline Integrity Monitor Missing Authorization
cve-program ·
Vendor product: Pipeline Integrity Monitor
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.