CVE-2026-85617Published
snipe-it before 8.6.3 Authorization Bypass via Bulk Delete
cve-program ·
Vendor product: snipe-it
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700870 source statements · aliases may refer to the same vulnerabilityCVE-2026-85606Published
firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath
cve-program ·
Vendor product: firecrawl-mcp-server
CVE-2026-85620Published
Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function
cve-program ·
Vendor product: postgres-mcp
CVE-2026-85625Published
sift 17.1.3 Prototype Pollution Remote Code Execution via $where
cve-program ·
Vendor product: sift.js
CVE-2026-85661Published
excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode
cve-program ·
Vendor product: excel-mcp-server
CVE-2026-85666Published
ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url
cve-program ·
Vendor product: ogx
CVE-2026-85671Published
QAnything 2.0.0 Unauthenticated Cross-User File Disclosure
cve-program ·
Vendor product: QAnything
CVE-2026-85676Published
Dub Open Redirect via Unrestricted redir_url Parameter
cve-program ·
Vendor product: dub
CVE-2026-85688Published
TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer
cve-program ·
Vendor product: ten-framework
CVE-2026-85693Published
Chatbot UI Cross-User Private File Content Disclosure via Retrieval API
cve-program ·
Vendor product: chatbot-ui
CVE-2026-85698Published
Turso through 0.8.0-pre.8 Out-of-Bounds Read Denial of Service
cve-program ·
Vendor product: turso
CVE-2026-86090Published
ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers
cve-program ·
Vendor product: ntopng
CVE-2026-86098Published
ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape
cve-program ·
https://github.com/ntop/nDPI: nDPI
CVE-2026-86714Published
PX4 Autopilot through 1.17.0 Stack Buffer Over-read via netman
cve-program ·
https://github.com/PX4/PX4-Autopilot: PX4-Autopilot
CVE-2026-73191Published
Apache Syncope: CAS service URL injection via Forwarded HTTP headers
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope:syncope-sra
CVE-2026-73236Published
Apache Syncope: Cross-Realm authorization bypass in delegated administration
cve-program ·
Vendor product: Apache Syncope
CVE-2026-73370Published
Apache Syncope: Cross-Realm boundaries reconciliation bypass
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core.idm:syncope-core-idm-logic
CVE-2026-73178Published
Apache Syncope: JWT Access Token takeover
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-provisioning-java
CVE-2026-73470Published
Apache Syncope: Delegating users can grant unowned Roles
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-provisioning-java
CVE-2026-50018Published
Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions
cve-program ·
Vendor product: hoverfly
CVE-2026-73579Published
Apache Syncope: Non-recursive Any search could skip Realms restrictions
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-persistence-common
CVE-2026-75015Published
Apache Syncope: Nested secrets leak cleartext into audit records readable
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-provisioning-java
CVE-2026-75030Published
Apache Syncope: Incomplete authorization checks for Group members deprovisioning
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core.idrepo:syncope-core-idrepo-logic
CVE-2026-77051Published
Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-persistence-jpa
CVE-2026-78299Published
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on dis…
cve-program ·
Vendor product: Eclipse Embedded CDT (C/C++ Development Tools)
CVE-2026-85200Published
GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
cve-program ·
Vendor product: GEO my WP
CVE-2026-78006Published
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
cve-program ·
Vendor product: The Events Calendar
CVE-2026-77161Published
Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
cve-program ·
Vendor product: Smart Marketing SMS and Newsletters Forms
CVE-2026-10148Published
Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter
cve-program ·
Vendor product: Booking for Appointments and Events Calendar – Amelia
CVE-2026-86349Published
Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting
cve-program ·
Vendor product: Mattermost
CVE-2026-86348Published
MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
cve-program ·
Vendor product: Mattermost
CVE-2026-82920Published
Mattermost ABAC parent policy bypass via policy update endpoint
cve-program ·
Vendor product: Mattermost
CVE-2026-7848Published
SQL Injection in Alior Bank raty PrestaShop module
cve-program ·
Vendor product: raty
CVE-2026-15600Published
SQL Injection in Alior Bank raty PrestaShop module
cve-program ·
Vendor product: raty
CVE-2026-88819Published
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
cve-program ·
Vendor product: Eclipse Data Plane Core
CVE-2026-81301Published
Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access
cve-program ·
Vendor product: File Manager
CVE-2026-4103Published
Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution
cve-program ·
Vendor product: WSO2 API Control Plane · Vendor product: WSO2 API Manager
CVE-2026-19543Published
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
cve-program ·
Vendor product: Common Licensing
CVE-2026-18515Published
IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
cve-program ·
Vendor product: i
CVE-2026-78336Published
Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic
CVE-2026-78330Published
Apache Syncope: Privilege escalation for admin user via JWT authentication
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-spring
CVE-2026-61534Published
Yayson: Prototype pollution in the Store/LegacyStore deserialization
cve-program ·
Vendor product: yayson
CVE-2026-57125Published
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
cve-program ·
Vendor product: PraisonAI · Vendor product: praisonaiagents
CVE-2026-78318Published
Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui
CVE-2026-50270Published
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
cve-program ·
Vendor product: dd-trace-java · Vendor product: dd-java-agent
CVE-2026-77883Published
Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-provisioning-api
CVE-2026-77181Published
Apache Syncope: ClientApp update entitlement not effective
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core.am:syncope-core-am-logic
CVE-2026-57126Published
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
cve-program ·
Vendor product: PraisonAI
CVE-2026-73668Published
Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core.idm:syncope-core-idm-logic
CVE-2026-90808Published
HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist
cve-program ·
Vendor product: nanobot
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.