CVE-2026-117507Published
a2aproject a2a-java TaskManager.saveTaskEvent race condition
cve-program ·
Vendor product: a2a-java
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
690448 source statements · aliases may refer to the same vulnerabilityGHSA-qrh6-cwg3-343xPublished
Ghost: Authorization Bypass in Comment Like Feature
osv · BIT-ghost-2026-103288 · CVE-2026-103288
npm: ghost
GHSA-c8r8-95hg-mp34Published
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files
osv · CVE-2026-60083
Go: github.com/siyuan-note/siyuan/kernel
GHSA-wj4w-mc24-pcfmWithdrawn
Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature
osv ·
npm: ghost
GHSA-wx4j-mvgx-mqwpPublished
Satori-generated SVG has improper escaping
osv · CVE-2026-94545
npm: satori
GHSA-q84f-53jg-9ppmPublished
better-auth: Device login approval does not show the requesting client or permissions
osv · CVE-2026-109346
npm: better-auth
CVE-2026-28167Published
WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability
cve-program ·
https://wordpress.org/plugins: super-forms
CVE-2026-117506Published
a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
cve-program ·
Vendor product: a2a-java
CVE-2026-117604Published
Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
cve-program ·
Vendor product: grav
CVE-2026-105987Published
Stored XSS in KGS Software tia Viewer
cve-program ·
Vendor product: tia Viewer
CVE-2026-115927Published
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
cve-program ·
Vendor product: tornado
CVE-2026-116479Published
a2aproject a2a-java JSON-RPC Error getMessage information exposure
cve-program ·
Vendor product: a2a-java
CVE-2026-83398Published
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated atta…
cve-program ·
Vendor product: Oracle Data Integrator
CVE-2026-116575Published
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
cve-program ·
Vendor product: mem0
CVE-2026-116579Published
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
cve-program ·
Vendor product: autobahn-python
CVE-2026-116504Published
TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection
cve-program ·
Vendor product: A950RG
CVE-2026-116583Published
Seroval: Code injection through a typed array's own constructor property
cve-program ·
Vendor product: seroval
CVE-2026-116587Published
Go JOSE: DoS when parsing JWKs that contain RSA keys
cve-program ·
Vendor product: go-jose
CVE-2026-116507Published
TOTOLINK A950RG global.so getLanguageCfg information disclosure
cve-program ·
Vendor product: A950RG
CVE-2026-116726Published
gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title
cve-program ·
Vendor product: gbsplay
CVE-2026-116730Published
Furnace through 0.6.8.3 Out-of-Bounds Read via FamiTracker Module Import
cve-program ·
Vendor product: furnace
CVE-2026-116734Published
flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
cve-program ·
Vendor product: flatcc
CVE-2026-116738Published
VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder
cve-program ·
Vendor product: vmime
CVE-2026-116742Published
HTSlib through 1.24 Heap Out-of-Bounds Write via Truncated .gzi Index Count
cve-program ·
Vendor product: htslib
CVE-2026-116746Published
QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
cve-program ·
Vendor product: qloapps
CVE-2026-116591Published
compress zstd: Panic on two-block frames
cve-program ·
Vendor product: compress
CVE-2026-116515Published
itsourcecode Online Book Store book.php sql injection
cve-program ·
Vendor product: Online Book Store
CVE-2026-116556Published
Argilla TextField.vue cross site scripting
cve-program ·
Vendor product: Argilla
CVE-2026-116801Published
Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
cve-program ·
Vendor product: parse-server · Vendor product: parse-server
CVE-2026-116805Published
OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list
cve-program ·
Vendor product: openpanel
CVE-2026-116809Published
OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
cve-program ·
Vendor product: openpanel
CVE-2026-116813Published
OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts
cve-program ·
Vendor product: openpanel
CVE-2026-116818Published
OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
cve-program ·
Vendor product: openpanel
CVE-2026-116822Published
YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
cve-program ·
Vendor product: yeswiki
CVE-2026-116826Published
YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
cve-program ·
Vendor product: yeswiki
CVE-2026-116604Published
SourceCodester Online Food Ordering System delete_admin.php missing authentication
cve-program ·
Vendor product: Online Food Ordering System
CVE-2026-116620Published
Tencent RapidJSON Regex stream.h Take out-of-bounds
cve-program ·
Vendor product: RapidJSON
CVE-2024-58400Published
llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
cve-program ·
Vendor product: llama.cpp
CVE-2026-116840Published
llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader
cve-program ·
Vendor product: llama.cpp
CVE-2026-116640Published
Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting
cve-program ·
Vendor product: HR-Payroll-Management-System
CVE-2026-92885Published
Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login
cve-program ·
Vendor product: Qode Membership
CVE-2026-116874Published
SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-83394Published
Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows low privileged attacker with netw…
cve-program ·
Vendor product: Oracle Demand Planning
CVE-2026-116878Published
Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarity
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-116882Published
Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-116886Published
Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-116890Published
Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-116894Published
REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
cve-program ·
Vendor product: core
CVE-2026-116898Published
REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
cve-program ·
Vendor product: core
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.