CVE-2026-115216Published
Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials
cve-program ·
Vendor product: Eclipse ioFog
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
690450 source statements · aliases may refer to the same vulnerabilityCVE-2026-101840Published
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high pri…
cve-program ·
Vendor product: Oracle Contract Lifecycle Management for Public Sector
CVE-2026-41022Published
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easyS…
cve-program ·
Vendor product: easySoft
CVE-2026-101837Published
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with…
cve-program ·
Vendor product: Oracle Shipping Execution
CVE-2026-112362Published
@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets
cve-program ·
Vendor product: @fastify/express
CVE-2026-101836Published
Vulnerability in the iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…
cve-program ·
Vendor product: iSupplier Portal
CVE-2026-101835Published
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with …
cve-program ·
Vendor product: Oracle Shipping Execution
CVE-2026-101833Published
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wi…
cve-program ·
Vendor product: Oracle Shipping Execution
CVE-2026-101832Published
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker…
cve-program ·
Vendor product: Oracle Order Management
CVE-2026-117499Published
@fastify/session vulnerable to session revocation bypass via a logout race condition
cve-program ·
Vendor product: @fastify/session
CVE-2026-101388Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network acces…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-56084Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-101387Published
Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network…
cve-program ·
Vendor product: Oracle Capacity
CVE-2026-101386Published
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST …
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101385Published
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST D…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101383Published
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST D…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101382Published
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST …
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101381Published
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Dat…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-113729Published
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization
cve-program ·
Vendor product: signedxml
CVE-2026-102800Published
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0
cve-program ·
Vendor product: com_djhelpfularticles
CVE-2016-20101Published
Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php
cve-program ·
Vendor product: Issuu Panel
CVE-2015-20123Published
Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php
cve-program ·
Vendor product: Aspose Doc Exporter
CVE-2012-20005Published
SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter
cve-program ·
Vendor product: SocialFit
CVE-2026-4337Published
Unrestricted Upload of File in PuMuKIT application
cve-program ·
Vendor product: PuMuKIT
CVE-2026-113724Published
virtualenv: Deletion recovery can change a symlink target's mode
cve-program ·
Vendor product: virtualenv
CVE-2026-113719Published
virtualenv: Seed replacement does not contain metadata deletion paths
cve-program ·
Vendor product: virtualenv
CVE-2026-117540Published
svg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping Loop
cve-program ·
Vendor product: svg-sanitizer
CVE-2026-117539Published
darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass
cve-program ·
Vendor product: svg-sanitizer
CVE-2026-117538Published
REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter
cve-program ·
Vendor product: core
CVE-2026-117536Published
REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
cve-program ·
Vendor product: core
CVE-2026-117535Published
REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
cve-program ·
Vendor product: core
CVE-2026-117534Published
REDAXO before 5.21.3 CSRF in Article History Plugin
cve-program ·
Vendor product: core
CVE-2026-117532Published
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
cve-program ·
Vendor product: core
CVE-2026-116899Published
REDAXO before 5.21.4 Broken Access Control in Slice Operations
cve-program ·
Vendor product: core
CVE-2026-116897Published
REDAXO before 5.21.4 Missing Authorization in Version and History Previews
cve-program ·
Vendor product: core
CVE-2026-116895Published
REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
cve-program ·
Vendor product: core
CVE-2026-116893Published
REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
cve-program ·
Vendor product: core
CVE-2026-113714Published
virtualenv: Downloaded wheel selection and caching precede verification
cve-program ·
Vendor product: virtualenv
GHSA-c6gr-qvv4-5v3fPublished
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
osv · CVE-2026-116802
npm: dompurify
GHSA-cg2g-xh64-v4q7Published
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
osv · CVE-2026-116804
npm: dompurify
GHSA-mrv2-3pqr-j5jrPublished
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
osv · CVE-2026-116803
npm: dompurify
CVE-2026-117466Published
In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.
cve-program ·
Vendor product: Octopus Server
CVE-2026-117341Published
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the a…
cve-program ·
Vendor product: Octopus Server
CVE-2026-116870Published
In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non legitimate issuer being accepted as a token belonging to a service account…
cve-program ·
Vendor product: Octopus Server
CVE-2026-116891Published
SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-116889Published
SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-116887Published
Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property
cve-program ·
Vendor product: SemanticMediaWiki
CVE-2026-116885Published
Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter
cve-program ·
Vendor product: SemanticMediaWiki
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.