CVE-2026-116151Published
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak in JNG Encoder
cve-program ·
Vendor product: ImageMagick · Vendor product: ImageMagick
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694331 source statements · aliases may refer to the same vulnerabilityCVE-2026-116155Published
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via Crafted XMP Profile
cve-program ·
Vendor product: ImageMagick · Vendor product: ImageMagick
CVE-2026-116159Published
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Memory Leak via -cdl Option
cve-program ·
Vendor product: ImageMagick · Vendor product: ImageMagick
CVE-2026-116163Published
Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
cve-program ·
Vendor product: parse-server · Vendor product: parse-server
CVE-2026-56721Published
CamaleonCMS 2.9.2 Privilege Escalation via Parameter Confusion in UsersController
cve-program ·
Vendor product: CamaleonCMS
CVE-2026-116167Published
SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter
cve-program ·
Vendor product: siyuan
CVE-2026-105773Published
Canimaan Software ClamXAV local privilege escalation
cve-program ·
Vendor product: ClamXAV
CVE-2026-109164Published
TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}
cve-program ·
https://github.com/TDuckCloud/tduck-survey-form: tduck-survey-form
CVE-2026-109171Published
yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check
cve-program ·
Vendor product: yshop-crm
CVE-2026-109176Published
MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files
cve-program ·
Vendor product: MoguBlog
CVE-2026-109331Published
Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget
cve-program ·
Vendor product: Network-AI
CVE-2026-109336Published
SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after
cve-program ·
Vendor product: surrealdb
CVE-2026-109341Published
SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations
cve-program ·
Vendor product: surrealdb
CVE-2026-109346Published
better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
cve-program ·
Vendor product: better-auth
CVE-2026-109351Published
Gitoxide gix-pack before 0.75.0 Denial of Service via Pack Header Object Count
cve-program ·
Vendor product: gix-pack
CVE-2026-109356Published
LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController
cve-program ·
Vendor product: librenms
CVE-2026-109566Published
Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder
cve-program ·
Vendor product: rapyd-admin
CVE-2026-109571Published
Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE
cve-program ·
Vendor product: BSW013
CVE-2026-109574Published
Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback
cve-program ·
Vendor product: hugo
CVE-2026-94402Published
IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
cve-program ·
Vendor product: @carbon/charts · Vendor product: @carbon/charts-react · Vendor product: @carbon/charts-angular
CVE-2026-76296Published
Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise
cve-program ·
Vendor product: Splunk Enterprise
CVE-2026-76304Published
Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR
cve-program ·
Vendor product: Splunk SOAR
CVE-2026-76308Published
Missing Authorization through the REST API in Splunk SOAR
cve-program ·
Vendor product: Splunk SOAR
CVE-2026-114716Published
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote…
cve-program ·
Vendor product: Webmail
CVE-2026-114720Published
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to …
cve-program ·
Vendor product: Webmail
CVE-2026-114728Published
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped…
cve-program ·
Vendor product: Webmail
CVE-2026-65184Published
Avocent ACS8000 wsserver command injection
cve-program ·
Vendor product: Avocent ACS8000
CVE-2026-93328Published
Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
cve-program ·
Vendor product: MCP Toolbox for Databases (googleapis/mcp-toolbox)
CVE-2026-93849Published
Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames
cve-program ·
Vendor product: Mattermost
CVE-2026-93850Published
Unbounded memory consumption during PDF text extraction
cve-program ·
Vendor product: Mattermost
CVE-2026-93848Published
Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
cve-program ·
Vendor product: Mattermost
CVE-2026-77054Published
Cleartext Storage of Sensitive Information in boneIO
cve-program ·
https://pypi.python.org: boneio
CVE-2026-77056Published
Use of Default Credentials in boneIO
cve-program ·
Vendor product: black_debian_images
CVE-2026-77058Published
Cross-Site Request Forgery (CSRF) in boneIO
cve-program ·
https://pypi.python.org: boneio
CVE-2026-116175Published
vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions
cve-program ·
Vendor product: vllm
CVE-2026-116179Published
vLLM 0.18.0 before 0.31.0 Memory Exhaustion via media_io_kwargs num_frames Override
cve-program ·
Vendor product: vllm
CVE-2026-116183Published
phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID
cve-program ·
Vendor product: phpMyFAQ
CVE-2026-116187Published
Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads
cve-program ·
Vendor product: rclone
CVE-2026-116191Published
Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
cve-program ·
Vendor product: rclone
CVE-2026-116195Published
Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim
cve-program ·
Vendor product: rclone
CVE-2026-116199Published
Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
cve-program ·
Vendor product: snipe-it
CVE-2026-116203Published
YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters
cve-program ·
Vendor product: yeswiki
CVE-2026-116207Published
YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
cve-program ·
Vendor product: yeswiki · Vendor product: yeswiki
CVE-2026-116053Published
dbcli mycli Whitelist source.py source_special_command_is_safe os command injection
cve-program ·
Vendor product: mycli
CVE-2026-116056Published
KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery
cve-program ·
Vendor product: KodExplorer
CVE-2026-116060Published
SourceCodester Performance Indicator System adddealer.php sql injection
cve-program ·
Vendor product: Performance Indicator System
CVE-2026-116063Published
DedeCMS update_guide.php require_once code injection
cve-program ·
Vendor product: DedeCMS
CVE-2026-95127Published
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c
cve-program ·
Vendor product: n/a
CVE-2026-116096Published
ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
cve-program ·
Vendor product: llama.cpp
CVE-2026-116099Published
Fusion Creators Studio SCP Containment Breach Multiplayer Skynet++ Virtual Machine BlitzBanks out-of-bounds write
cve-program ·
Vendor product: SCP Containment Breach Multiplayer
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.