CVE-2022-50457Published
mtd: core: Fix refcount error in del_mtd_device()
cve-program ·
Vendor product: Linux · Vendor product: Linux
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
693857 source statements · aliases may refer to the same vulnerabilityCVE-2022-50167Published
bpf: fix potential 32-bit overflow when accessing ARRAY map element
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2022-49622Published
netfilter: nf_tables: avoid skb access on nf_stolen
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2022-49106Published
staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-87865Published
knownhost callback mismatches key as missing
cve-program ·
Vendor product: curl
CVE-2026-87864Published
IMAP APPEND plus CRLF conversion command injection
cve-program ·
Vendor product: curl
CVE-2026-87862Published
HSTS cache import drops longer-lived child
cve-program ·
Vendor product: curl
CVE-2026-87861Published
cross-origin reuse of a Negotiate connection
cve-program ·
Vendor product: curl
CVE-2026-86413Published
Negotiate credentials sent to redirected origin
cve-program ·
Vendor product: curl
RUSTSEC-2026-0426Published
LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time
osv · GHSA-r7wm-4vf2-h44w
crates.io: orion
RUSTSEC-2026-0427Published
`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)
osv ·
crates.io: sn-releases
RUSTSEC-2026-0428Published
BLAKE2b produces wrong tag when using `reset()` with a different-length key
osv · GHSA-xcc6-f2jq-43x6
crates.io: orion
CVE-2026-110681Published
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
CVE-2026-110680Published
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv
cve-program ·
https://cpan.org/modules: Cpanel-JSON-XS
GHSA-9cqf-hhrq-7v45Published
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route
osv · CVE-2026-73608 · GO-2026-6632
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6632Published
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-73608 · GHSA-9cqf-hhrq-7v45
Go: github.com/siyuan-note/siyuan/kernel
GHSA-57v5-wqx3-cgj4Published
SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews
osv · CVE-2026-72791 · GO-2026-6430
Go: github.com/siyuan-note/siyuan/kernel
GO-2026-6430Published
SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel
osv · CVE-2026-72791 · GHSA-57v5-wqx3-cgj4
Go: github.com/siyuan-note/siyuan/kernel
CVE-2024-9287Published
Virtual environment (venv) activation scripts don't quote paths
cve-program ·
Vendor product: CPython
RUSTSEC-2026-0423Published
Cross-engine type confusion with host-created struct-types-with-supertypes
osv · GHSA-qw58-7h65-crq2
crates.io: wasmtime
RUSTSEC-2026-0425Published
`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)
osv ·
crates.io: nix-nar
RUSTSEC-2026-0424Published
Unchecked memory usage in transferring borrowed resources between components
osv · GHSA-6fr9-xmw9-5352
crates.io: wasmtime
RUSTSEC-2026-0420Published
wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving
osv · GHSA-hmmr-87qq-258j
crates.io: wasmtime-wasi
RUSTSEC-2026-0422Published
Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check
osv · GHSA-3982-jqvv-277m
crates.io: wasmtime
RUSTSEC-2026-0421Published
wasi-http p2: outgoing content-length can be invalid or not match body
osv · GHSA-h4wp-g4x3-7398
crates.io: wasmtime-wasi-http
CVE-2026-81726Published
NLTK through 3.10.3 Path Traversal via Model-Artifact APIs
cve-program ·
Vendor product: nltk
CVE-2026-112192Published
MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
cve-program ·
Vendor product: MISP
CVE-2026-118952Published
Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: kroxylicious-authorizer-acl · https://access.redhat.com/downloads/content/package-browser/: kroxylicious-authorizer-acl
CVE-2026-104795Published
Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution
cve-program ·
https://catalog.redhat.com/software/containers/: openshift4/insights-runtime-extractor-rhel9 · https://catalog.redhat.com/software/containers/: openshift4/insights-runtime-extractor-rhel9 · https://catalog.redhat.com/software/containers/: openshift4/insights-runtime-extractor-rhel9
CVE-2026-93017Published
Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader
cve-program ·
https://catalog.redhat.com/software/containers/: openshift4/ose-insights-rhel8-operator · https://catalog.redhat.com/software/containers/: openshift4/ose-insights-rhel8-operator · https://catalog.redhat.com/software/containers/: openshift4/ose-insights-rhel9-operator
CVE-2026-83589Published
Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect
cve-program ·
https://catalog.redhat.com/software/containers/: openshift4/ose-oauth-proxy · https://catalog.redhat.com/software/containers/: openshift4/ose-oauth-proxy · https://catalog.redhat.com/software/containers/: openshift4/ose-oauth-proxy-rhel9
CVE-2026-49329Published
Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints
cve-program ·
https://catalog.redhat.com/software/containers/: openshift4/ose-oauth-server-rhel8 · https://catalog.redhat.com/software/containers/: openshift4/ose-oauth-server-rhel9 · https://catalog.redhat.com/software/containers/: openshift4/ose-oauth-server-rhel9
CVE-2026-104328Published
Langflow OSS is affected by multiple vulnerabilities
cve-program ·
Vendor product: Langflow OSS
CVE-2026-104339Published
Langflow OSS is affected by multiple vulnerabilities
cve-program ·
Vendor product: Langflow OSS
CVE-2026-107328Published
Langflow OSS is affected by multiple vulnerabilities
cve-program ·
Vendor product: Langflow OSS
CVE-2026-110193Published
Langflow OSS is affected by multiple vulnerabilities
cve-program ·
Vendor product: Langflow OSS
CVE-2026-110309Published
Langflow OSS is affected by multiple vulnerabilities
cve-program ·
Vendor product: Langflow OSS
CVE-2026-93851Published
Path traversal in Mattermost Agents plugin mention reminder allows plugin replacement via crafted post
cve-program ·
Vendor product: Mattermost
CVE-2026-90720Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-115713Published
Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification
cve-program ·
Vendor product: Elastic Cloud Enterprise
CVE-2026-86395Published
Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.…
cve-program ·
Vendor product: PowerProtect Data Domain Virtual Edition
CVE-2026-86393Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-86389Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-21157Published
Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.
cve-program ·
Vendor product: Bixby
CVE-2026-76418Published
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability
cve-program ·
Vendor product: Cisco Secure Firewall Adaptive Security Appliance (ASA) Software · Vendor product: Cisco Secure Firewall Threat Defense (FTD) Software
CVE-2026-87302Published
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthe…
cve-program ·
Vendor product: Oracle WebLogic Server
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.