CVE-2026-46531Published
Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)
cve-program ·
Vendor product: cacti
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694117 source statements · aliases may refer to the same vulnerabilityCVE-2026-55465Published
Goobi viewer: Solr injection via unvalidated region parameter in spatial search
cve-program ·
Vendor product: goobi-viewer-core
CVE-2026-88041Published
Apache Tomcat: HTTP/2 trailer header cross-contamination
cve-program ·
Vendor product: Apache Tomcat
CVE-2026-91245Published
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attac…
cve-program ·
Vendor product: Oracle WebCenter Portal
CVE-2026-55444Published
Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
cve-program ·
Vendor product: goobi-viewer-core
CVE-2026-91246Published
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attac…
cve-program ·
Vendor product: Oracle WebCenter Portal
CVE-2026-46651Published
Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
cve-program ·
Vendor product: goobi-viewer-core
CVE-2026-80353Published
Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
cve-program ·
Vendor product: Apache Tomcat
CVE-2026-115477Published
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
cve-program ·
Vendor product: obsidian-tc
CVE-2026-114621Published
baserCMS: SQL injection in the admin panel and admin API
cve-program ·
Vendor product: basercms
CVE-2026-89009Published
WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server
cve-program ·
Vendor product: WN535M1 · Vendor product: WN535M3
CVE-2026-74049Published
Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
cve-program ·
Vendor product: Apache Tomcat
CVE-2026-89010Published
WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server
cve-program ·
Vendor product: WN535M1 · Vendor product: WN535M3
CVE-2026-115480Published
baserCMS: Public Web API mail-form submission bypasses image CAPTCHA
cve-program ·
Vendor product: basercms
CVE-2026-74048Published
Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
cve-program ·
Vendor product: Apache Tomcat
GHSA-6q5m-63h6-5x4vPublished
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
osv · CVE-2026-33287
npm: liquidjs
CVE-2026-87743Published
Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
cve-program ·
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: quarkus-vertx-http · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: quarkus-vertx-http · https://catalog.redhat.com/software/containers/: devspaces/multicluster-redirector-rhel9
CVE-2026-91248Published
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attac…
cve-program ·
Vendor product: Oracle WebCenter Portal
CVE-2026-113399Published
Incorrect boundary conditions in the SVG component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-91217Published
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with…
cve-program ·
Vendor product: Oracle SOA Suite
CVE-2026-55606Published
odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
cve-program ·
Vendor product: odhcpd
CVE-2026-91216Published
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with…
cve-program ·
Vendor product: Oracle SOA Suite
CVE-2026-115751Published
mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname
cve-program ·
Vendor product: mcp-from-openapi
CVE-2026-115729Published
@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass
cve-program ·
Vendor product: common
CVE-2026-34485Published
A CLI ACL Bypass vulnerability in Nokia 1830 Global Express (GX)
cve-program ·
Vendor product: Nokia 1830 Global Express (GX)
CVE-2026-34484Published
A Shell Privilege Escalation vulnerability in Nokia 1830 Global Express (GX)
cve-program ·
Vendor product: Nokia 1830 Global Express (GX)
CVE-2026-108088Published
Apache Cocoon: Cross-user cache poisoning
cve-program ·
Vendor product: Apache Cocoon
CVE-2026-86977Published
An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.
cve-program ·
Vendor product: iOS and iPadOS
CVE-2026-118656Published
Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
cve-program ·
Vendor product: echo
CVE-2026-118660Published
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
cve-program ·
Vendor product: happy-dom
CVE-2026-118664Published
decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
cve-program ·
Vendor product: decode-uri-component
CVE-2026-118668Published
LangGraph JavaScript custom authentication may permit cross-user Store access
cve-program ·
Vendor product: langgraph-api
CVE-2026-118690Published
Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
cve-program ·
Vendor product: signalk-server
CVE-2026-118694Published
python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
cve-program ·
Vendor product: python-markdown2
CVE-2026-118755Published
Volmarg Personal Management System through 2.1.0 OS Command Injection via Storage Folder Path
cve-program ·
Vendor product: personal-management-system
CVE-2026-118804Published
Bricks Broken Access Control via query_result Endpoint
cve-program ·
Vendor product: Bricks Builder
CVE-2026-54455Published
OpenCATS: Authenticated SQL injection in activity DataGrid date filters
cve-program ·
Vendor product: OpenCATS
CVE-2026-111946Published
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header
cve-program ·
https://cpan.org/modules: Plack-Middleware-ETag
CVE-2026-61573Published
AVideo-Encoder: reflected cross-site scripting in the login interface
cve-program ·
Vendor product: AVideo-Encoder
CVE-2026-61575Published
AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
cve-program ·
Vendor product: AVideo-Encoder
CVE-2026-118538Published
a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes
cve-program ·
Vendor product: a2ui
CVE-2026-82411Published
Objects API: Cross-object-type authorization bypass on the object history-detail endpoint
cve-program ·
Vendor product: open-object
CVE-2026-118579Published
D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor
cve-program ·
Vendor product: DIR-505
CVE-2026-118589Published
nschloe meshio VTK Reader _vtk_42.py memory allocation
cve-program ·
Vendor product: meshio
CVE-2026-117859Published
Keycloak-services: keycloak-services: par single-use bypass via flow restart
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: keycloak-services · https://access.redhat.com/downloads/content/package-browser/: rhbk/keycloak-rhel9 · https://access.redhat.com/downloads/content/package-browser/: keycloak-services
CVE-2026-119027Published
oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension
cve-program ·
Vendor product: oapi-codegen
CVE-2026-119048Published
JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module
cve-program ·
Vendor product: JeeSite
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.