CVE-2025-22039Published
ksmbd: fix overflow in dacloffset bounds check
cve-program ·
Vendor product: Linux · Vendor product: Linux
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
699878 source statements · aliases may refer to the same vulnerabilityCVE-2026-82792Published
Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: CAN-2-WF · Vendor product: CAN-2-USB
CVE-2025-21649Published
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-58097Published
wifi: ath11k: fix RCU stall while reaping monitor destination ring
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-56639Published
net: hsr: must allocate more bytes for RedBox support
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-50029Published
Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-50017Published
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-35887Published
ax25: fix use-after-free bugs caused by ax25_ds_del_timer
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2023-52676Published
bpf: Guard stack limits against 32bit overflow
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2022-48650Published
scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-90704Published
D-Link DWR-M921 formDiskPartition system command injection
cve-program ·
Vendor product: DWR-M921
CVE-2026-90709Published
Yot CMS Admin Console admin.php eval code injection
cve-program ·
Vendor product: CMS
CVE-2026-82793Published
Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on t…
cve-program ·
Vendor product: CAN-2-WF · Vendor product: CAN-2-USB
CVE-2026-82794Published
SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
cve-program ·
Vendor product: SV-CPT-MC310 · Vendor product: SV-CPT-MC310F
CVE-2026-85196Published
Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0
cve-program ·
Vendor product: plg_system_articlesanywhere · Vendor product: plg_system_usersanywhere
CVE-2026-88852Published
Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.0.0
cve-program ·
Vendor product: plg_system_snippets · Vendor product: plg_system_snippets
CVE-2026-85192Published
Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0
cve-program ·
Vendor product: plg_system_conditionalcontent
CVE-2026-85195Published
Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0
cve-program ·
Vendor product: plg_system_articlesanywhere
CVE-2026-85188Published
Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (Pro) < 16.2.0 for Joomla
cve-program ·
Vendor product: plg_system_advancedmodules · Vendor product: plg_system_conditionalcontent · Vendor product: plg_system_contenttemplater
CVE-2026-15892Published
Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of service
cve-program ·
https://github.com/zephyrproject-rtos/zephyr: zephyr
CVE-2026-16726Published
Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows
cve-program ·
Vendor product: PANATERM v6 · Vendor product: PANATERM for Multi · Vendor product: PANATERM v7
CVE-2026-68955Published
The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the priv…
cve-program ·
Vendor product: The installer for Rakuten Kobo Desktop Application (Windows version)
CVE-2026-82762Published
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary OS command may be executed b…
cve-program ·
Vendor product: FXA5000 · Vendor product: FXA5020 · Vendor product: FXA5020-[][]
CVE-2026-82764Published
Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed.
cve-program ·
Vendor product: FXA5000 · Vendor product: FXA5020 · Vendor product: FXA5020-[][]
CVE-2026-82767Published
Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: SGA1000
CVE-2026-82769Published
Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: RP-WAH-SR1 · Vendor product: RP-WAH-SR2 · Vendor product: RP-WAH-SR12
CVE-2026-82770Published
Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program may be executed.
cve-program ·
Vendor product: RP-WAH-SR1 · Vendor product: RP-WAH-SR2 · Vendor product: RP-WAH-SR12
CVE-2026-82771Published
Cross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: ECE1000 · Vendor product: ECE1020 · Vendor product: ECS1020
CVE-2026-82772Published
Buffer overflow vulnerability exists in Contec EC1000 series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program may be executed.
cve-program ·
Vendor product: ECE1000 · Vendor product: ECE1020 · Vendor product: ECS1020
CVE-2026-82773Published
Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: M2M Gateway Integrated Type CPS-MG341* · Vendor product: M2M Gateway Configurable type CPS-MGS341* · Vendor product: M2M Controller Integrated Type CPS-MC341
CVE-2026-82774Published
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary OS command may be …
cve-program ·
Vendor product: M2M Gateway Integrated Type CPS-MG341* · Vendor product: M2M Gateway Configurable type CPS-MGS341* · Vendor product: M2M Controller Integrated Type CPS-MC341
CVE-2026-82775Published
An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the direct…
cve-program ·
Vendor product: M2M Gateway Integrated Type CPS-MG341* · Vendor product: M2M Gateway Configurable type CPS-MGS341* · Vendor product: M2M Controller Integrated Type CPS-MC341
CVE-2026-82776Published
Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: Integrated Type CPS-PC341[][]-*-9201 · Vendor product: Configurable type CPS-PCS341[][]-DS1-1201
CVE-2026-82777Published
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to th…
cve-program ·
Vendor product: Integrated Type CPS-PC341[][]-*-9201 · Vendor product: Configurable type CPS-PCS341[][]-DS1-1201
CVE-2026-82778Published
An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication.
cve-program ·
Vendor product: Integrated Type CPS-PC341[][]-*-9201 · Vendor product: Configurable type CPS-PCS341[][]-DS1-1201
CVE-2026-82779Published
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the…
cve-program ·
Vendor product: CPS-TM341G5MB-ADSC1-931 · Vendor product: CPS-TM341MB-ADSC1-931 · Vendor product: CPS-TM341GMB-ADSC1-931
CVE-2026-82780Published
Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. If a specially crafted file is uploaded by a remote authenticated attacker, an arbitrary command may be executed on the product.
cve-program ·
Vendor product: CPS-TM341G5MB-ADSC1-931 · Vendor product: CPS-TM341MB-ADSC1-931 · Vendor product: CPS-TM341GMB-ADSC1-931
CVE-2026-82781Published
Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* · Vendor product: Remote I/O Coupler Unit (EtherNet/IP Adapter) CPSN-EOB471EI-[]1 · Vendor product: Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041
CVE-2026-82782Published
Out-of-bounds write vulnerability exists in CONPROSYS nano Series. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.
cve-program ·
Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* · Vendor product: Remote I/O Coupler Unit (EtherNet/IP Adapter) CPSN-EOB471EI-[]1 · Vendor product: Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041
CVE-2026-82783Published
Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may obtain credentials.
cve-program ·
Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* · Vendor product: Remote I/O Coupler Unit (EtherNet/IP Adapter) CPSN-EOB471EI-[]1 · Vendor product: Programmable Remote I/O Coupler Unit (Software PLC Type) CPSN-PCB271-S1-041
CVE-2026-82784Published
Missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/o…
cve-program ·
Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
CVE-2026-82785Published
Stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.
cve-program ·
Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
CVE-2026-82786Published
Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. If this vulnerability is exploited, sensitive information may be restored from a backup file.
cve-program ·
Vendor product: Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
CVE-2026-82788Published
Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: CPSL-08P1EN
CVE-2026-82763Published
Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: FXA5000 · Vendor product: FXA5020 · Vendor product: FXA5020-[][]
CVE-2026-90898Published
Bifrost unauthenticated remote code execution via MCP stdio client registration
cve-program ·
https://github.com/maximhq/bifrost: github.com/maximhq/bifrost/transports
CVE-2026-89180Published
Thinking Software Technology｜EFence - SQL Injection
cve-program ·
Vendor product: EFence
CVE-2026-12882Published
Mattermost Markdown autolink parsing denial of service
cve-program ·
Vendor product: Mattermost
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.