CVE-2026-118604Published
Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability
cve-program ·
Vendor product: iLX-F511
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
690188 source statements · aliases may refer to the same vulnerabilityCVE-2026-118603Published
Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
cve-program ·
Vendor product: iLX-F511
CVE-2026-118602Published
Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability
cve-program ·
Vendor product: iLX-F511
CVE-2026-118601Published
Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability
cve-program ·
Vendor product: iLX-F511
CVE-2026-88967Published
Azure Monitor access token disclosure via SSRF
cve-program ·
Vendor product: Grafana Enterprise · Vendor product: Grafana OSS
CVE-2026-91209Published
Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure…
cve-program ·
Vendor product: Oracle Solaris
CVE-2026-100105Published
Alerting contact point authorization bypass via schema downgrade
cve-program ·
Vendor product: Grafana Enterprise · Vendor product: Grafana OSS
CVE-2026-114256Published
oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection
cve-program ·
Vendor product: file-management-system-php
CVE-2023-38473Published
Reachable assertion in avahi_alternative_host_name
cve-program ·
https://github.com/avahi/avahi: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi
CVE-2026-117626Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the n…
cve-program ·
Vendor product: Jenkins
CVE-2026-117624Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing…
cve-program ·
Vendor product: Jenkins
CVE-2026-117623Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar overflow menu entries, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/…
cve-program ·
Vendor product: Jenkins
CVE-2026-117622Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in contr…
cve-program ·
Vendor product: Jenkins
CVE-2026-117621Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace browser for each file and directory, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers in con…
cve-program ·
Vendor product: Jenkins
CVE-2026-117620Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding exis…
cve-program ·
Vendor product: Jenkins
CVE-2026-117619Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to reta…
cve-program ·
Vendor product: Jenkins
CVE-2026-117618Published
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to …
cve-program ·
Vendor product: Jenkins
CVE-2026-117617Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace …
cve-program ·
Vendor product: Jenkins
CVE-2026-117616Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as…
cve-program ·
Vendor product: Jenkins
CVE-2026-117615Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controll…
cve-program ·
Vendor product: Jenkins
CVE-2026-117614Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator,…
cve-program ·
Vendor product: Jenkins
CVE-2026-117613Published
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files that can lead to, e.g…
cve-program ·
Vendor product: Jenkins
CVE-2026-91208Published
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where…
cve-program ·
Vendor product: Oracle Solaris
CVE-2023-38472Published
Reachable assertion in avahi_rdata_parse
cve-program ·
https://github.com/avahi/avahi: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi
CVE-2026-112375Published
Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.kafka:kafka
CVE-2026-114243Published
dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection
cve-program ·
Vendor product: Insurance-Management-System
CVE-2023-38471Published
Reachable assertion in dbus_set_host_name
cve-program ·
https://github.com/avahi/avahi: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi
CVE-2026-87399Published
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with netw…
cve-program ·
Vendor product: Oracle WebCenter Content
CVE-2026-91212Published
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthentica…
cve-program ·
Vendor product: Oracle Identity Manager Connector
CVE-2023-38470Published
Reachable assertion in avahi_escape_label
cve-program ·
https://github.com/avahi/avahi: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi
CVE-2026-113789Published
pypdf: Possible long runtimes/large memory usage when retrieving form fields
cve-program ·
Vendor product: pypdf
CVE-2026-113721Published
virtualenv: Generated files can follow existing destination links
cve-program ·
Vendor product: virtualenv
CVE-2026-111758Published
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
cve-program ·
Vendor product: markdown-it
CVE-2012-20002Published
TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php
cve-program ·
Vendor product: TinyMCE Thumbnail Gallery
CVE-2026-106079Published
Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
cve-program ·
Vendor product: Session Smart Router · Vendor product: Session Smart Conductor
CVE-2014-125132Published
Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php
cve-program ·
Vendor product: Blogroll Fun
CVE-2026-110985Published
Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.kafka:kafka
CVE-2026-103411Published
Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing
cve-program ·
Vendor product: Session Smart Router
CVE-2026-110952Published
Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.kafka:kafka
CVE-2026-114253Published
oretnom23 file-management-system-php index.php include file inclusion
cve-program ·
Vendor product: file-management-system-php
CVE-2026-103409Published
Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
cve-program ·
Vendor product: Session Smart Router
CVE-2023-38469Published
Reachable assertion in avahi_dns_packet_append_record
cve-program ·
https://github.com/avahi/avahi: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi · https://access.redhat.com/downloads/content/package-browser/: avahi
CVE-2026-103408Published
Session Smart Router: An attacker-controlled input causes remote code execution when parsing DHCP options
cve-program ·
Vendor product: Session Smart Router
CVE-2026-103407Published
Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management
cve-program ·
Vendor product: Session Smart Router · Vendor product: Session Smart Conductor
CVE-2015-20125Published
Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php
cve-program ·
Vendor product: Aspose PDF Exporter
CVE-2026-74989Published
Internally found bugs fixed in Firefox 154
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-74988Published
Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-74950Published
Privilege escalation in the Downloads API component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.