Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700872 source statements · aliases may refer to the same vulnerabilityFrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
osv · CVE-2026-59973
npm: mcp-from-openapi · npm: @frontmcp/adapters · npm: frontmcp
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
osv · CVE-2026-59148
npm: @mockoon/commons-server · npm: @mockoon/cli
yayson: Prototype pollution in Store/LegacyStore deserialization
osv · CVE-2026-61534
npm: yayson
@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)
osv · CVE-2026-59149
npm: @mockoon/commons-server · npm: @mockoon/cli
Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution
cve-program ·
Vendor product: Fireware OS · Vendor product: Fireware OS
Acrobat Reader | Integer Underflow (Wrap or Wraparound) (CWE-191)
cve-program ·
Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024
Acrobat Reader | Out-of-bounds Read (CWE-125)
cve-program ·
Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024
Acrobat Reader | Uncontrolled Resource Consumption (CWE-400)
cve-program ·
Vendor product: Adobe Acrobat · Vendor product: Acrobat Reader · Vendor product: Acrobat 2024
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.opennlp:opennlp-core · https://repo.maven.apache.org/maven2: org.apache.opennlp:opennlp-tools
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
cve-program ·
Vendor product: Adobe Experience Manager as a Cloud Service · Vendor product: Adobe Experience Manager 6.5 LTS · Vendor product: Adobe Experience Manager 6.5
seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization
cve-program ·
Vendor product: CPA-Manager-Plus
Adobe Commerce | Incorrect Authorization (CWE-863)
cve-program ·
Vendor product: Adobe Commerce · Vendor product: Adobe Commerce B2B · Vendor product: Magento Open Source
ningzichun Student Management System Backup example.7z information disclosure
cve-program ·
Vendor product: Student Management System
InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
cve-program ·
Vendor product: icms2
light0011 cms Chapter Controller ChapterController.class.php _initialize authorization
cve-program ·
Vendor product: cms
itsourcecode Sales and Inventory System inv_del.php sql injection
cve-program ·
Vendor product: Sales and Inventory System
code-projects Doctor Appointment System booking.php sql injection
cve-program ·
Vendor product: Doctor Appointment System
code-projects Vehicle Management System busprofile.php sql injection
cve-program ·
Vendor product: Vehicle Management System
ramon-victor freegpt-webui Jailbreak Mode backend.py getJailbreak allocation of resources
cve-program ·
Vendor product: freegpt-webui
Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection
cve-program ·
Vendor product: CP3
SourceCodester Online Voting System ajax.php delete_category sql injection
cve-program ·
Vendor product: Online Voting System
Tenda HG10 Boa Web Server formWanRedirect buffer overflow
cve-program ·
Vendor product: HG10
DefaultFuction CRM delete.php sql injection
cve-program ·
Vendor product: CRM
diem-project diem dmWidget BasedmWidgetActions.class.php authorization
cve-program ·
Vendor product: diem
code-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql information disclosure
cve-program ·
Vendor product: Hotel and Tourism Reservation in PHP
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.