CVE-2026-0305Published
Prisma Access Agent: Information Disclosure Vulnerability on Linux
cve-program ·
Vendor product: Prisma Access Agent · Vendor product: Prisma Access Agent
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
700900 source statements · aliases may refer to the same vulnerabilityCVE-2026-0303Published
Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File
cve-program ·
Vendor product: Checkov by Prisma Cloud
CVE-2026-0302Published
Checkov by Prisma Cloud: OS Command Injection Vulnerability
cve-program ·
Vendor product: Checkov by Prisma Cloud
CVE-2026-87962Published
t-digest 3.1 through 3.3 Denial of Service via Unvalidated Length Fields in MergingDigest.fromBytes
cve-program ·
https://repo1.maven.org/maven2/com/tdunning/t-digest/: t-digest
CVE-2026-5399Published
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
cve-program ·
Vendor product: Redux Framework
CVE-2026-87874Published
Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: ansible-collection-community-general · https://access.redhat.com/downloads/content/package-browser/: ansible-collection-community-general · https://access.redhat.com/downloads/content/package-browser/: ansible-collection-community-general
CVE-2026-88269Published
GV-LPC2011/LPC2211 - SSVR Guest Configuration and Credential Disclosure
cve-program ·
Vendor product: GV-LPC2011/LPC2211
CVE-2026-88268Published
GV-LPC2011/LPC2211 - SSVR Fragment-Reassembly Stack Overflow Denial of Service
cve-program ·
Vendor product: GV-LPCLPC2011/2211
CVE-2026-59679Published
fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2
cve-program ·
Vendor product: libXfont2-2 · Vendor product: libXfont2-2 · Vendor product: libXfont2-2
CVE-2026-7188Published
SQLi in Armiya Information Technologies' Access Control System
cve-program ·
Vendor product: Access Control System
CVE-2026-17038Published
Use of Hard-coded Credentials in drEryk Gabinet
cve-program ·
Vendor product: drEryk Gabinet
CVE-2026-9161Published
User Enumeration in DernekPlus' Website Template
cve-program ·
Vendor product: Website Template
CVE-2026-9163Published
SQLi in GIS Informatics' GisLab Laboratory Management System
cve-program ·
Vendor product: GisLab Laboratory Management System
CVE-2026-88038Published
cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cve-program ·
Vendor product: cookies
CVE-2026-9166Published
LFI in GIS Informatics' GisLab Laboratory Management System
cve-program ·
Vendor product: GisLab Laboratory Management System
GHSA-8wv5-x4w7-5gwwPublished
Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop
osv · BIT-thrift-2026-43871 · CVE-2026-43871 · PYSEC-2026-3926
PyPI: thrift · Go: github.com/apache/thrift · Packagist: apache/thrift
CVE-2026-44990Published
Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
cve-program ·
Vendor product: sanitize-html
CVE-2026-42033Published
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
cve-program ·
Vendor product: axios
CVE-2026-26278Published
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
cve-program ·
Vendor product: fast-xml-parser
CVE-2026-6734Published
undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse
cve-program ·
Vendor product: undici
CVE-2025-48431Published
Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
cve-program ·
Vendor product: Apache Thrift
CVE-2026-4599Published
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can…
cve-program ·
Vendor product: jsrsasign · Vendor product: org.webjars.npm:jsrsasign
CVE-2026-4600Published
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/dsa-2…
cve-program ·
Vendor product: jsrsasign · Vendor product: org.webjars.npm:jsrsasign
CVE-2026-28802Published
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
cve-program ·
Vendor product: authlib
CVE-2026-32286Published
Denial of service in github.com/jackc/pgproto3/v2
cve-program ·
https://pkg.go.dev: github.com/jackc/pgproto3/v2
CVE-2026-32597Published
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
cve-program ·
Vendor product: pyjwt
CVE-2026-9804Published
Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read
cve-program ·
https://catalog.redhat.com/software/containers/: container-native-virtualization/virt-exportserver-rhel9 · https://catalog.redhat.com/software/containers/: container-native-virtualization/virt-exportserver-rhel9 · https://catalog.redhat.com/software/containers/: container-native-virtualization/virt-exportserver-rhel9
CVE-2026-27606Published
Rollup 4 has Arbitrary File Write via Path Traversal
cve-program ·
Vendor product: rollup
CVE-2026-22797Published
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication hea…
cve-program ·
Vendor product: keystonemiddleware
CVE-2026-25639Published
Axios affected by Denial of Service via __proto__ Key in mergeConfig
cve-program ·
Vendor product: axios
CVE-2026-29063Published
Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
cve-program ·
Vendor product: immutable-js
CVE-2026-32589Published
Mirror-registry: quay: insecure direct object reference in blobupload
cve-program ·
https://catalog.redhat.com/software/containers/: openshift/mirror-registry-rhel8 · https://catalog.redhat.com/software/containers/: quay/quay-rhel8 · https://catalog.redhat.com/software/containers/: quay/quay-rhel8
CVE-2026-7374Published
Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability
cve-program ·
https://github.com/kubevirt/kubevirt: kubevirt · https://catalog.redhat.com/software/containers/: container-native-virtualization/virt-handler · https://catalog.redhat.com/software/containers/: container-native-virtualization/virt-handler-rhel9
CVE-2026-41674Published
xmldom: XML injection through unvalidated DocumentType serialization
cve-program ·
Vendor product: xmldom
CVE-2026-52987Published
drm/amdgpu: avoid double drm_exec_fini() in userq validate
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-42151Published
Prometheus Azure AD remote write OAuth client secret exposed via config API
cve-program ·
Vendor product: prometheus
CVE-2025-54518Published
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.
cve-program ·
Vendor product: AMD EPYC™ 7002 Series Processors · Vendor product: AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics · Vendor product: AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
CVE-2026-29074Published
SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
cve-program ·
Vendor product: svgo
CVE-2026-6321Published
fast-uri vulnerable to path traversal via percent-encoded dot segments
cve-program ·
Vendor product: fast-uri
CVE-2026-22029Published
React Router vulnerable to XSS via Open Redirects
cve-program ·
Vendor product: react-router · Vendor product: @remix-run/router
CVE-2026-27962Published
Authlib JWS JWK Header Injection: Signature Verification Bypass
cve-program ·
Vendor product: authlib
CVE-2026-4598Published
Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the p…
cve-program ·
Vendor product: jsrsasign · Vendor product: org.webjars.npm:jsrsasign
CVE-2026-42039Published
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
cve-program ·
Vendor product: axios
CVE-2026-9697Published
undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent
cve-program ·
Vendor product: undici
CVE-2025-61731Published
Arbitrary file write using cgo pkg-config directive in cmd/go
cve-program ·
https://pkg.go.dev: cmd/go
CVE-2026-4602Published
Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break s…
cve-program ·
Vendor product: jsrsasign · Vendor product: org.webjars.npm:jsrsasign
CVE-2026-4601Published
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to…
cve-program ·
Vendor product: jsrsasign · Vendor product: org.webjars.npm:jsrsasign
CVE-2026-33894Published
Forge has signature forgery in RSA-PKCS due to ASN.1 extra field
cve-program ·
Vendor product: forge
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.