CVE-2026-86077Published
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
cve-program ·
Vendor product: n8n
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700871 source statements · aliases may refer to the same vulnerabilityCVE-2026-0532Published
External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector
cve-program ·
Vendor product: Kibana
CVE-2026-28780Published
Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
cve-program ·
Vendor product: Apache HTTP Server
CVE-2025-69264Published
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
cve-program ·
Vendor product: pnpm
CVE-2026-40983Published
Micrometer gRPC server instrumentation DoS vulnerability
cve-program ·
Vendor product: Micrometer
CVE-2026-54369Published
acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions
cve-program ·
Vendor product: acl
CVE-2026-42536Published
Apache HTTP Server: mod_xml2enc heap overflow
cve-program ·
Vendor product: Apache HTTP Server
CVE-2026-54513Published
jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
cve-program ·
Vendor product: jackson-databind
CVE-2026-1526Published
undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
cve-program ·
https://github.com/nodejs/undici/: undici
CVE-2026-3009Published
Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)
cve-program ·
https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator
CVE-2026-2229Published
undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation
cve-program ·
https://github.com/nodejs/undici/: undici
CVE-2026-2332Published
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
cve-program ·
https://repo.maven.apache.org/maven2: pkg://maven/org.eclipse.jetty/jetty-http
CVE-2026-6951Published
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equi…
cve-program ·
Vendor product: simple-git · Vendor product: org.webjars.npm:simple-git
CVE-2026-42055Published
NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability
cve-program ·
Vendor product: NGINX Open Source · Vendor product: NGINX Plus
CVE-2026-44185Published
Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
cve-program ·
Vendor product: Apache HTTP Server
CVE-2026-9277Published
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
cve-program ·
https://www.npmjs.com/package/shell-quote: shell-quote
CVE-2026-34355Published
Apache HTTP Server: mod_proxy_html buffer overflow
cve-program ·
Vendor product: Apache HTTP Server
CVE-2026-5795Published
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
cve-program ·
Vendor product: Eclipse Jetty
CVE-2026-40984Published
Micrometer HTTP server instrumentations DoS vulnerability
cve-program ·
Vendor product: micrometer-core · Vendor product: micrometer-jetty11 · Vendor product: micrometer-jetty12
CVE-2025-68493Published
Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component
cve-program ·
https://repo.maven.apache.org/maven2: com.opensymphony:xwork · https://repo.maven.apache.org/maven2: org.apache.struts.xwork:xwork-core
CVE-2025-69263Published
pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies
cve-program ·
Vendor product: pnpm
CVE-2026-1528Published
undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
cve-program ·
https://github.com/nodejs/undici/: undici
CVE-2026-86082Published
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
cve-program ·
Vendor product: n8n
CVE-2026-86085Published
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
cve-program ·
Vendor product: n8n
CVE-2026-80912Published
selinux: reject an unclaimed class value in security_get_classes()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-80878Published
afs: Fix leak of ungot volume
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-80671Published
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-74371Published
bpf: fix BPF_PROG_QUERY OOB write and cgroup backward compat
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-64058Published
netfs: Fix netfs_read_folio() to wait on writeback
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-64031Published
erofs: fix managed cache race for unaligned extents
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-64016Published
ksmbd: fix durable reconnect error path file lifetime
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-53098Published
wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-53010Published
ksmbd: fix use-after-free in smb2_open during durable reconnect
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-52944Published
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-46305Published
staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31420Published
bridge: mrp: reject zero test interval to avoid OOM panic
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-23201Published
ceph: fix oops due to invalid pointer for kfree() in parse_longname()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2025-39991Published
wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2025-38266Published
pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2025-37833Published
net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2025-37802Published
ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2025-23129Published
wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2025-22103Published
net: fix NULL pointer dereference in l3mdev_l3_rcv
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2025-22101Published
net: libwx: fix Tx L4 checksum
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2025-22039Published
ksmbd: fix overflow in dacloffset bounds check
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-82792Published
Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
cve-program ·
Vendor product: CAN-2-WF · Vendor product: CAN-2-USB
CVE-2025-21649Published
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-58097Published
wifi: ath11k: fix RCU stall while reaping monitor destination ring
cve-program ·
Vendor product: Linux · Vendor product: Linux
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.