CVE-2022-51023Published
PHPOK < 5.4.081 SQL Injection via api.php sort Parameter
cve-program ·
Vendor product: PHPOK
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694160 source statements · aliases may refer to the same vulnerabilityCVE-2026-11854Published
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
cve-program ·
Vendor product: WSO2 API Manager · Vendor product: WSO2 API Control Plane · Vendor product: WSO2 Identity Server
CVE-2026-3583Published
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
cve-program ·
Vendor product: WSO2 API Manager · Vendor product: WSO2 Traffic Manager · Vendor product: WSO2 Universal Gateway
CVE-2026-6647Published
Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
cve-program ·
Vendor product: WSO2 Identity Server · Vendor product: org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth
CVE-2026-78674Published
Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
cve-program ·
Vendor product: Enterprise Integrator (BPS profile) · Vendor product: Business Process Server
CVE-2026-16889Published
Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin
cve-program ·
Vendor product: openEQUELLA
CVE-2026-66088Published
Unrestricted Command Execution via system.execute
cve-program ·
Vendor product: openEQUELLA
CVE-2026-66089Published
XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
cve-program ·
Vendor product: openEQUELLA
CVE-2026-66090Published
XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
cve-program ·
Vendor product: openEQUELLA
CVE-2026-66091Published
Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
cve-program ·
Vendor product: openEQUELLA
CVE-2026-66092Published
Stored XSS in pre-login notice via reachable legacy logon route
cve-program ·
Vendor product: openEQUELLA
CVE-2026-113387Published
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary …
cve-program ·
Vendor product: ortto
CVE-2026-114173Published
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected stor…
cve-program ·
Vendor product: ortto
CVE-2026-113409Published
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in a…
cve-program ·
Vendor product: ortto
CVE-2026-114645Published
Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping
cve-program ·
Vendor product: C Driver
CVE-2026-115417Published
Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt
cve-program ·
Vendor product: aws-c-mqtt
CVE-2026-25716Published
BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
cve-program ·
https://github.com/wikimedia/mediawiki-extensions-BlueSpiceUserManager: Extension:BlueSpiceUserManager
CVE-2026-116839Published
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the…
cve-program ·
Vendor product: airMAX M
CVE-2026-90732Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, con…
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-90731Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-68866Published
PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Rel…
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-90725Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-93862Published
Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service
cve-program ·
Vendor product: Fireware OS · Vendor product: Fireware OS
CVE-2026-90721Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-86392Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-86391Published
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through …
cve-program ·
Vendor product: PowerProtect Data Domain Management Center
CVE-2026-101365Published
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise O…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-92665Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-101407Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Change Assistant). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-86377Published
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain …
cve-program ·
Vendor product: PowerProtect Data Domain
CVE-2026-101412Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with lo…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-103390Published
Session Smart Router and Session Smart Conductor: A malformed HTTP URI causes a service crash during HTTP application identification
cve-program ·
Vendor product: Session Smart Router · Vendor product: Session Smart Conductor
CVE-2026-101415Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with ne…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-103394Published
Session Smart Router: An incomplete operator causes the use of incorrect encryption keys during security policy updates.
cve-program ·
Vendor product: Session Smart Router
CVE-2026-101432Published
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon…
cve-program ·
Vendor product: PeopleSoft Enterprise PeopleTools
CVE-2026-103400Published
Session Smart Router and Session Smart Conductor: Crafted directory names cause arbitrary filesystem unmounting during service cleanup
cve-program ·
Vendor product: Session Smart Router · Vendor product: Session Smart Conductor
CVE-2026-101459Published
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network ac…
cve-program ·
Vendor product: Siebel CRM Deployment
CVE-2026-103410Published
Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection
cve-program ·
Vendor product: Session Smart Router
CVE-2026-101471Published
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with…
cve-program ·
Vendor product: Oracle Product Lifecycle Analytics
CVE-2026-101474Published
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows …
cve-program ·
Vendor product: Oracle Agile Product Lifecycle Management for Process
CVE-2026-101497Published
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Connector Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged …
cve-program ·
Vendor product: Oracle Identity Manager
CVE-2026-101502Published
Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). The supported version that is affected is 26.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Trus…
cve-program ·
Vendor product: Oracle Trusted Answer Search
CVE-2026-101524Published
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framework). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthent…
cve-program ·
Vendor product: Oracle Enterprise Manager Base Platform
CVE-2026-101570Published
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network ac…
cve-program ·
Vendor product: Helidon
CVE-2026-101575Published
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to com…
cve-program ·
Vendor product: Helidon
CVE-2026-101583Published
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper). Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with n…
cve-program ·
Vendor product: Helidon
CVE-2026-101593Published
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows lo…
cve-program ·
Vendor product: Oracle Agile Product Lifecycle Management for Process
CVE-2026-91238Published
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with …
cve-program ·
Vendor product: Oracle SOA Suite
CVE-2026-91247Published
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated att…
cve-program ·
Vendor product: Oracle WebCenter Portal
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.