Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700890 source statements · aliases may refer to the same vulnerabilityn8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
osv · CVE-2026-86077
npm: n8n · npm: n8n
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
osv · CVE-2026-86083
npm: n8n · npm: n8n · npm: n8n
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
osv · CVE-2026-88056
npm: @angular/platform-server · npm: @angular/platform-server · npm: @angular/platform-server
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
osv · CVE-2026-88057
npm: @angular/core · npm: @angular/compiler · npm: @angular/core
Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`
osv · CVE-2026-88059
npm: @angular/common · npm: @angular/common · npm: @angular/common
OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host
cve-program ·
Vendor product: Meridian · Vendor product: Horizon
Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600
cve-program ·
Vendor product: TL-MR6400 v8 · Vendor product: Archer MR600
Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600
cve-program ·
Vendor product: TL-MR6400 v8 · Vendor product: Archer MR600
OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
cve-program ·
Vendor product: Horizon
Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller
cve-program ·
https://github.com/concretecms/concretecms: Concrete CMS
Consul vulnerable to an authorization bypass in the catalog deregistration path
cve-program ·
Vendor product: Consul · Vendor product: Consul Enterprise
Consul-template vulnerable to an information disclosure issue in error handling
cve-program ·
Vendor product: Tooling
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
cve-program ·
Vendor product: angular
Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low…
cve-program ·
Vendor product: Chrome
Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially bypass system access restrictions via crafted network traffic. (Chromium security …
cve-program ·
Vendor product: Chrome
DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
cve-program ·
Vendor product: cJSON
Consul vulnerable to an authorization bypass in the catalog node-write path
cve-program ·
Vendor product: Consul · Vendor product: Consul Enterprise
Consul vulnerable to a denial of service in the native RPC listener
cve-program ·
Vendor product: Consul · Vendor product: Consul Enterprise
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailb…
cve-program ·
Vendor product: Cyrus IMAP
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
cve-program ·
Vendor product: WebSphere Application Server
An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read p…
cve-program ·
Vendor product: Cyrus IMAP
Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent
cve-program ·
Vendor product: Amazon SSM Agent
zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.
cve-program ·
Vendor product: n/a
Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)
cve-program ·
Vendor product: Apache Nutch
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.