CVE-2026-8301Published
OS Command Injection in TUBITAK BILGEM's Pardus-boot-repair
cve-program ·
Vendor product: Pardus Boot Repair
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700879 source statements · aliases may refer to the same vulnerabilityCVE-2026-8044Published
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup …
cve-program ·
Vendor product: EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert)
CVE-2026-87988Published
An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside th…
cve-program ·
Vendor product: mistral-vibe
CVE-2026-87987Published
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling…
cve-program ·
Vendor product: mistral-vibe
CVE-2026-15710Published
Netskope Client Endpoint DLP Kernel Driver Information Leakage
cve-program ·
Vendor product: Endpoint DLP
CVE-2026-87020Published
Orthanc DICOM Server Integer Overflow or Wraparound
cve-program ·
Vendor product: DICOM Server
CVE-2026-8303Published
Privilege Escalation in TUBITAK BILGEM's Pardus-software
cve-program ·
Vendor product: Pardus-software
CVE-2026-82583Published
NextGen Healthcare Mirth Connect SQL Injection
cve-program ·
Vendor product: Mirth Connect
CVE-2026-78224Published
NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference
cve-program ·
Vendor product: Mirth Connect
CVE-2026-82578Published
NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference
cve-program ·
Vendor product: Mirth Connect
CVE-2026-87983Published
An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during pa…
cve-program ·
Vendor product: mistral-vibe
CVE-2026-87984Published
An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permissi…
cve-program ·
Vendor product: mistral-vibe
CVE-2026-87985Published
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute ar…
cve-program ·
Vendor product: mistral-vibe
CVE-2026-87986Published
An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands …
cve-program ·
Vendor product: mistral-vibe
CVE-2026-16172Published
Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash
cve-program ·
Vendor product: Endpoint DLP
CVE-2026-45759Published
Suricata http1: quadratic Content-Disposition processing can lead to denial of service
cve-program ·
Vendor product: suricata
CVE-2026-89089Published
OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)
cve-program ·
Vendor product: Meridian · Vendor product: Horizon
CVE-2026-3096Published
Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft
cve-program ·
Vendor product: WSO2 API Control Plane · Vendor product: WSO2 API Manager
CVE-2026-9225Published
Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
cve-program ·
Vendor product: Langflow OSS
CVE-2026-75940Published
A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.
cve-program ·
Vendor product: Health Application
CVE-2026-19136Published
A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially craft…
cve-program ·
Vendor product: Tianxi AI Agent PC Application
CVE-2026-18994Published
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files withi…
cve-program ·
Vendor product: File Manager Application
CVE-2026-11813Published
A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges.
cve-program ·
Vendor product: FileZ Client · Vendor product: FileZ Enterprise
CVE-2026-87958Published
IBM® Db2® is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions
cve-program ·
Vendor product: Db2
CVE-2026-82100Published
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
CVE-2026-45766Published
Suricata nfs: unbounded stateful structures can lead to resource exhaustion
cve-program ·
Vendor product: suricata
CVE-2026-82092Published
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
CVE-2026-81265Published
Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
cve-program ·
Vendor product: Langflow OSS
CVE-2026-38057Published
ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery
cve-program ·
Vendor product: Evolution iQ‑Series terminals · Vendor product: 3315-Series terminals · Vendor product: 9-Series Terminals
CVE-2026-80378Published
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
cve-program ·
Vendor product: DataStage on Cloud Pak for Data
CVE-2026-38059Published
ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function
cve-program ·
Vendor product: Evolution iQ‑Series terminals · Vendor product: 3315-Series terminals · Vendor product: 9-Series Terminals
CVE-2026-45770Published
Suricata lua: excessive flow variable registration can bypass sandbox
cve-program ·
Vendor product: suricata
CVE-2026-75777Published
Multiple vulnerabilities in IBM Aspera Enterprise Webapps
cve-program ·
Vendor product: Aspera Enterprise WebApps
CVE-2026-16174Published
Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow
cve-program ·
Vendor product: Endpoint DLP
CVE-2026-71416Published
Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)
cve-program ·
Vendor product: headroom
CVE-2026-18121Published
Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-81905Published
Concrete CMS below 9.5.3 does not enforce validation-hash type on redemption, allowing a hash issued for one purpose to be redeemed for another.
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-81824Published
AVEVA Pipeline Integrity Monitor cross-site scripting
cve-program ·
Vendor product: Pipeline Integrity Monitor
CVE-2026-81822Published
AVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic Algorithm
cve-program ·
Vendor product: Pipeline Integrity Monitor
CVE-2026-81906Published
[UNREVIEWED] OAuth Callback Login Bypasses Deactivated-Account Checks
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
CVE-2026-19486Published
SSRF in Gemini Enterprise Agent Platform App Builder
cve-program ·
Vendor product: Gemini Enterprise Agent Platform App Builder
CVE-2026-81821Published
AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key
cve-program ·
Vendor product: Pipeline Integrity Monitor
CVE-2026-89145Published
Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory
cve-program ·
Vendor product: flextype
CVE-2026-47839Published
Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin
cve-program ·
Vendor product: UAA · Vendor product: cf-deployment
CVE-2026-78129Published
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
cve-program ·
Vendor product: strongSwan
CVE-2026-78134Published
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.
cve-program ·
Vendor product: strongSwan
CVE-2026-15462Published
Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
cve-program ·
Vendor product: Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.