CVE-2026-38626Published
Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php.
cve-program ·
Vendor product: n/a
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700870 source statements · aliases may refer to the same vulnerabilityCVE-2026-77147Published
Apache Syncope: Groovy Sandbox escape for empty CommandArgs
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-spring
CVE-2026-73195Published
Apache Syncope: CSV export spreadsheet formula injection
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.syncope.core:syncope-core-provisioning-java
CVE-2026-90495Published
Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection
cve-program ·
Vendor product: Feng Office
CVE-2026-90500Published
lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload
cve-program ·
Vendor product: vhr
CVE-2026-90505Published
vvbbnn00 WARP-Clash-API doUpdateLicenseKey race condition
cve-program ·
Vendor product: WARP-Clash-API
CVE-2026-47256Published
OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token
cve-program ·
Vendor product: opentelemetry-collector-contrib · Vendor product: github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter
CVE-2026-90806Published
DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization
cve-program ·
Vendor product: django-crm
CVE-2026-90510Published
dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key
cve-program ·
Vendor product: orion-visor
CVE-2026-48054Published
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri
cve-program ·
Vendor product: contracts-wizard
CVE-2026-57579Published
Alchemy: Unauthenticated nested page API leaks restricted & unpublished content
cve-program ·
Vendor product: alchemy_cms
CVE-2026-50276Published
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
cve-program ·
Vendor product: dd-trace-rb
CVE-2026-46696Published
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls
cve-program ·
Vendor product: system
CVE-2026-53495Published
containerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service
cve-program ·
Vendor product: containerd
CVE-2026-90516Published
SourceCodester School Registration and Fee System pay_report.php sql injection
cve-program ·
Vendor product: School Registration and Fee System
MAL-2026-16152Published
Malicious code in strapi-plugin-os-info-meeb322k (npm)
osv ·
npm: strapi-plugin-os-info-meeb322k
CVE-2026-90782Published
S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()
cve-program ·
Vendor product: S2OPC
CVE-2026-90521Published
jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorization
cve-program ·
Vendor product: Tourism-Management-System
CVE-2026-90526Published
SourceCodester School Registration and Fee System save_class.php sql injection
cve-program ·
Vendor product: School Registration and Fee System
CVE-2026-90564Published
quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting
cve-program ·
Vendor product: shiyi-blog
CVE-2026-55102Published
hashi-vault-js: Vault token and secret values exposed in thrown errors
cve-program ·
Vendor product: hashi-vault-js
CVE-2026-55072Published
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
cve-program ·
Vendor product: pimcore
CVE-2026-90569Published
linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting
cve-program ·
Vendor product: litemall
CVE-2026-90803Published
GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow
cve-program ·
Vendor product: Binutils
CVE-2026-87921Published
Rizwan17 inventory-management-system manage.php update_record sql injection
cve-program ·
Vendor product: inventory-management-system
CVE-2026-90574Published
itsourcecode Sales and Inventory System emp_transac.php add sql injection
cve-program ·
Vendor product: Sales and Inventory System
CVE-2026-90579Published
cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
cve-program ·
Vendor product: Cheshire Cat AI
CVE-2026-90584Published
TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
cve-program ·
Vendor product: Java-WebSocket
CVE-2026-90597Published
itsourcecode Sales and Inventory System sup_edit1.php sql injection
cve-program ·
Vendor product: Sales and Inventory System
CVE-2026-77827Published
Maono Link local privilege escalation
cve-program ·
Vendor product: Maono Link
CVE-2026-90602Published
Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting
cve-program ·
Vendor product: Open-Generative-AI
CVE-2026-23787Published
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A Use-After-Free in the Exynos DRM HDR driver (due to improper cleanup upon vmap failure) leads to a kernel crash.
cve-program ·
Vendor product: Exynos 1280 firmware
CVE-2026-23792Published
An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410. Incorrect handling of unauthenticated downlink RRC Set…
cve-program ·
Vendor product: Exynos 1080 firmware
CVE-2026-33960Published
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A malformed ioctl command to the Wi-Fi interface device can lead to improper buffer size allocation, re…
cve-program ·
Vendor product: Exynos 1330 firmware
CVE-2026-33967Published
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera driver, an out-of-bounds array access vulnerability in the error-handling path leads to memory corruption…
cve-program ·
Vendor product: Exynos 1330 firmware
CVE-2026-90792Published
GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference
cve-program ·
Vendor product: GPAC
CVE-2026-57127Published
praisonai: recipe serve auth middleware silently disables itself when no secret is set
cve-program ·
Vendor product: PraisonAI
MAL-2026-16146Published
Malicious code in @aiwfm/communitywfm.scripts.api (npm)
osv ·
npm: @aiwfm/communitywfm.scripts.api
CVE-2026-47701Published
OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
cve-program ·
Vendor product: opentelemetry-operator
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.