CVE-2026-55236Published
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
cve-program ·
Vendor product: langgraph-api
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700870 source statements · aliases may refer to the same vulnerabilityCVE-2026-54155Published
node-opcua: Missing nonce verification in UserNameIdentityToken authentication
cve-program ·
Vendor product: node-opcua
CVE-2026-37008Published
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's compl…
cve-program ·
Vendor product: CrewAI
CVE-2026-84445Published
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
cve-program ·
Vendor product: grpc-go
CVE-2026-54156Published
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
cve-program ·
Vendor product: node-opcua
CVE-2026-53708Published
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
cve-program ·
Vendor product: mcp-context-forge · Vendor product: mcp-contextforge-gateway
CVE-2026-90801Published
GNU Binutils ld cache.c cache_bwrite buffer overflow
cve-program ·
Vendor product: Binutils
CVE-2026-38924Published
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposi…
cve-program ·
Vendor product: Serena
MAL-2026-16124Published
Malicious code in tailwindcss-contact-forms (npm)
osv ·
npm: tailwindcss-contact-forms
CVE-2022-29567Published
Possible information disclosure inside TreeGrid component with default data provider
cve-program ·
https://repo.maven.apache.org/maven2: com.vaadin:vaadin · https://repo.maven.apache.org/maven2: com.vaadin:vaadin-grid-flow
CVE-2026-29810Published
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.
cve-program ·
Vendor product: CyberPanel
CVE-2026-54529Published
SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
cve-program ·
Vendor product: sqladmin
CVE-2023-22632Published
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.
cve-program ·
Vendor product: PRTG Network Monitor
CVE-2026-90794Published
GPAC MP4Box vrml_tools.c gf_sg_script_load use after free
cve-program ·
Vendor product: GPAC
CVE-2026-57131Published
praisonai: Jobs API exposes agent-execution endpoints with no authentication
cve-program ·
Vendor product: PraisonAI
CVE-2026-33964Published
An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformed message is sent to the camera driver, causing limited information disclosure or denial of service.
cve-program ·
Vendor product: Exynos 1580 firmware
CVE-2026-56839Published
PraisonAI Code agent tools fail open without a workspace boundary
cve-program ·
Vendor product: PraisonAI
CVE-2026-90691Published
0x4m4 HexStrike AI API Files Endpoint hexstrike_server.py FileOperationsManager path traversal
cve-program ·
Vendor product: HexStrike AI
CVE-2023-46035Published
The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.
cve-program ·
Vendor product: svg_optimizer
CVE-2026-90594Published
wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization
cve-program ·
Vendor product: Spring-Cloud-Platform
CVE-2026-90513Published
simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authentication
cve-program ·
Vendor product: api-lambda-send-email-ses
CVE-2023-24285Published
Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed.
cve-program ·
Vendor product: Portable Puzzle Collection
CVE-2026-79300Published
SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization d…
cve-program ·
Vendor product: sesam
CVE-2023-28148Published
A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.
cve-program ·
Vendor product: PRTG Network Monitor
CVE-2026-49462Published
nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default
cve-program ·
Vendor product: nl.nl-portal:app
CVE-2026-54174Published
melange: Incomplete package integrity verification allows data section substitution
cve-program ·
Vendor product: melange · Vendor product: apko
CVE-2026-45057Published
matrix-sdk-ui: Incomplete edit validation
cve-program ·
Vendor product: matrix-sdk-ui
CVE-2023-37252Published
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.
cve-program ·
Vendor product: CheckUser
CVE-2026-54241Published
libde265: SAO sequential filter heap buffer overflow via signed integer overflow
cve-program ·
Vendor product: libde265
CVE-2023-45858Published
A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.
cve-program ·
Vendor product: PRTG Network Monitor
CVE-2026-49992Published
Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
cve-program ·
Vendor product: kimai
CVE-2023-25500Published
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in …
cve-program ·
https://repo.maven.apache.org/maven2: com.vaadin:vaadin · https://repo.maven.apache.org/maven2: com.vaadin:flow-server
CVE-2023-50461Published
An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as …
cve-program ·
Vendor product: direct_mail
CVE-2026-78159Published
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
cve-program ·
Vendor product: The Events Calendar
CVE-2026-11355Published
DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions
cve-program ·
Vendor product: DT LMS – elearning, WordPress LMS Plugin
CVE-2026-90535Published
Flowise before 3.1.4 Denial of Service via text-to-speech/abort
cve-program ·
Vendor product: Flowise
CVE-2026-90540Published
WWBN AVideo Missing Authorization via playListAddVideo.json.php
cve-program ·
Vendor product: AVideo
CVE-2026-52297Published
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.
cve-program ·
Vendor product: FFmpeg
CVE-2026-90545Published
WWBN AVideo Missing Authorization via commentAddNew.json.php
cve-program ·
Vendor product: AVideo
CVE-2026-90550Published
WWBN AVideo Missing Authorization via mediaSession.json.php
cve-program ·
Vendor product: AVideo
CVE-2026-23790Published
An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A double-free vulnerability in the Samsung Exynos DPU driver (due to improper pointer management during DMA buffer r…
cve-program ·
Vendor product: Exynos 1280 firmware
CVE-2026-90555Published
vLLM before 0.28.0 Denial of Service via Audio Header
cve-program ·
Vendor product: vLLM
CVE-2026-25832Published
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.
cve-program ·
Vendor product: Mbed TLS
CVE-2026-15451Published
MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation
cve-program ·
Vendor product: MemberPress Corporate Accounts
CVE-2026-90607Published
Totolink A3002MU boa formNewSchedule buffer overflow
cve-program ·
Vendor product: A3002MU
CVE-2026-90560Published
zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress
cve-program ·
https://repo1.maven.org/maven2/com/github/luben/zstd-jni/: zstd-jni
CVE-2026-33956Published
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Sending a malformed message to the test_msg sysfs entry causes an out-of-bounds write, leading to denial of service.
cve-program ·
Vendor product: Exynos 1330 firmware
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.