CVE-2026-112945Published
Vite: Cross origin script execution through Vite custom middleware
cve-program ·
Vendor product: vite · Vendor product: vite-plus
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
690320 source statements · aliases may refer to the same vulnerabilityCVE-2026-87367Published
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 2…
cve-program ·
Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition
CVE-2026-87366Published
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker wit…
cve-program ·
Vendor product: Oracle Applications Framework
CVE-2026-113672Published
Argo CD: A Jsonnet import can read files from the repo-server
cve-program ·
Vendor product: argo-cd
CVE-2026-87365Published
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged atta…
cve-program ·
Vendor product: Oracle WebCenter Content
CVE-2026-87363Published
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with networ…
cve-program ·
Vendor product: Oracle Payroll
CVE-2026-87362Published
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network …
cve-program ·
Vendor product: Oracle Agile PLM
CVE-2026-112950Published
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
cve-program ·
Vendor product: vitest · Vendor product: mocker
CVE-2026-113650Published
ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
cve-program ·
Vendor product: apostrophe · Vendor product: sanitize-html
CVE-2026-87361Published
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with netw…
cve-program ·
Vendor product: Oracle WebCenter Content
CVE-2026-113654Published
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
cve-program ·
Vendor product: apostrophe · Vendor product: sanitize-html
CVE-2026-113659Published
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
cve-program ·
Vendor product: apostrophe
CVE-2026-113665Published
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
cve-program ·
Vendor product: apostrophe
CVE-2026-87360Published
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated a…
cve-program ·
Vendor product: Oracle WebCenter Content
CVE-2026-114101Published
Coraza before 3.8.1 Multipart filename* Charset Handling FILES Rule Bypass
cve-program ·
Vendor product: coraza
CVE-2026-114106Published
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
cve-program ·
Vendor product: Vibe-Trading
CVE-2026-87359Published
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with networ…
cve-program ·
Vendor product: Oracle Service Bus
CVE-2026-114111Published
Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
cve-program ·
Vendor product: sharp
CVE-2026-87358Published
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with…
cve-program ·
Vendor product: Oracle General Ledger
CVE-2026-114116Published
Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators
cve-program ·
Vendor product: vyper · Vendor product: vyper
CVE-2026-114096Published
Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
cve-program ·
Vendor product: dulwich
CVE-2026-87357Published
Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network …
cve-program ·
Vendor product: Order Capture
CVE-2026-105489Published
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
cve-program ·
Vendor product: Adobe Campaign Classic
CVE-2026-68567Published
WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: convertpro
CVE-2025-63031Published
WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: convertpro
CVE-2026-87355Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with ne…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-87354Published
Vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Operator). Supported versions that are affected are 22.1-22.1.40.0 and 26.1-26.1.1.2.0. Easily exploitable vulnerability allows low privileged attacker with networ…
cve-program ·
Vendor product: Oracle TimesTen In-Memory Database
CVE-2026-87353Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to …
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-87350Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to …
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-87348Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-87347Published
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with…
cve-program ·
Vendor product: Oracle HTTP Server
CVE-2026-116078Published
HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
cve-program ·
https://repo.hex.pm: bandit · https://github.com: mtrudel/bandit
CVE-2026-87345Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with …
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-50541Published
Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export
cve-program ·
Vendor product: xibo-cms
CVE-2026-87342Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network …
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-52729Published
Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion
cve-program ·
Vendor product: xibo-cms
CVE-2026-87330Published
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged a…
cve-program ·
Vendor product: JD Edwards EnterpriseOne Tools
CVE-2026-87319Published
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privilege…
cve-program ·
Vendor product: JD Edwards EnterpriseOne Tools
CVE-2026-87344Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-105420Published
Path Traversal in Wing WFTP Server leading to Remote Code Execution
cve-program ·
Vendor product: Wing FTP Server
CVE-2026-93517Published
X.Org Server GLX RenderLarge Heap Buffer Overflow
cve-program ·
Vendor product: xorg-x11-server · Vendor product: xwayland
CVE-2026-59177Published
ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
cve-program ·
Vendor product: device-builder
CVE-2026-59176Published
Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import
cve-program ·
Vendor product: functype
CVE-2026-87343Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network ac…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-87340Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network ac…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-93516Published
.Org Server XInput Passive Grab Use-After-Free
cve-program ·
Vendor product: xorg-x11-server · Vendor product: xwayland
CVE-2026-87339Published
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP…
cve-program ·
Vendor product: Siebel CRM Integration
CVE-2026-87338Published
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP …
cve-program ·
Vendor product: Siebel CRM Integration
CVE-2026-55369Published
Waline login accepts a non-string email as a match-all MongoDB query
cve-program ·
Vendor product: waline
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.