Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700886 source statements · aliases may refer to the same vulnerabilityMalicious code in datefmt-helper (npm)
osv · GHSA-ch48-496p-pfv8
npm: datefmt-helper
Malicious code in @across-toolkit/typescript-config (npm)
osv ·
npm: @across-toolkit/typescript-config
Low-privilege RCE through element-search eager loading
cve-program ·
https://packagist.org: craftcms/cms
Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit…
cve-program ·
Vendor product: ThinOS 10
Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop
cve-program ·
Vendor product: Fusion
Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.
cve-program ·
Vendor product: Samsung Mobile Devices
Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege.
cve-program ·
Vendor product: Samsung Mobile Devices
Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.
cve-program ·
Vendor product: Samsung Mobile Devices
Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code.
cve-program ·
Vendor product: Samsung Mobile Devices
In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n…
cve-program ·
Vendor product: Android
Authenticated Remote Code Execution in CPPM Web Interface
cve-program ·
Vendor product: ClearPass Policy Manager (CPPM)
Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface
cve-program ·
Vendor product: ClearPass Policy Manager (CPPM)
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially explo…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vu…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privi…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially explo…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Verification of Data Authenticity vulnerability. An unauthenticated attacker with remote access could ex…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged…
cve-program ·
Vendor product: Secure Connect Gateway 5.0 - Application · Vendor product: Secure Connect Gateway 5.0 - Appliance
In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for expl…
cve-program ·
Vendor product: Android
Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') …
cve-program ·
Vendor product: iDRAC9 · Vendor product: iDRAC10
Velociraptor Required Permissions bypass by using client monitoring queries
cve-program ·
Vendor product: Velociraptor
Velociraptor VQL injection during notebook restore from backup
cve-program ·
Vendor product: Velociraptor
Potential Leakage of Nintendo Switch System Information Through a Proximity-Based Remote Attack
cve-program ·
Vendor product: Nintendo Switch
In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for …
cve-program ·
Vendor product: Android
GlobalProtect App: Local Privilege Escalation Vulnerabilities
cve-program ·
Vendor product: GlobalProtect App · Vendor product: GlobalProtect App · Vendor product: GlobalProtect App
Cortex XDR Broker VM: Privilege Escalation Vulnerability
cve-program ·
Vendor product: Cortex XDR Broker VM
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
cve-program ·
Vendor product: RouterOS
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
cve-program ·
Vendor product: RouterOS
Application denial of service via cancellation race in reactive client-side encryption in MongoDB Java Driver
cve-program ·
Vendor product: Java Driver · Vendor product: org.mongodb:mongodb-crypt Maven package · Vendor product: org.mongodb:mongodb-driver-reactivestreams Maven package
Backblaze Client for Windows Improper Link Resolution Vulnerability
cve-program ·
Vendor product: Backblaze Client
@argos-ci/core: CI Branch Name OS Command Injection
osv · CVE-2026-59960
npm: @argos-ci/core
mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS
osv ·
crates.io: mistralrs-server-core
mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url
osv ·
crates.io: mistralrs-server-core
n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
osv · CVE-2026-86085
npm: n8n · npm: n8n
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
osv · CVE-2026-88062
npm: omniroute
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
osv · CVE-2026-86073
npm: n8n · npm: n8n
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
osv · CVE-2026-86074
npm: n8n · npm: n8n
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
osv · CVE-2026-86995
npm: n8n · npm: n8n · npm: n8n
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
osv · CVE-2026-86084
npm: n8n · npm: n8n · npm: n8n
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
osv · CVE-2026-86078
npm: n8n · npm: n8n
n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
osv · CVE-2026-86080
npm: n8n · npm: n8n · npm: n8n
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
osv · CVE-2026-86079
npm: n8n · npm: n8n · npm: n8n
n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
osv · CVE-2026-86993
npm: n8n · npm: n8n · npm: n8n
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.