Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694346 source statements · aliases may refer to the same vulnerabilityRace condition in `tokio::time::Interval` on Tokio v1.54.0
osv · CVE-2026-115567 · GHSA-5wjr-9356-4wc8
crates.io: tokio
Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
cve-program ·
https://packagist.org/: blueways/bw-captcha
SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
cve-program ·
https://packagist.org/: sgalinski/sg-cookie-optin
Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
osv · CVE-2026-115893 · GHSA-mghf-wjfp-p5xm
crates.io: wasmtime
Stores can mix up type indices between engines
osv · CVE-2026-115393 · GHSA-hgjw-h833-99q9
crates.io: wasmtime
Guest controlled-size host heap allocation through WASIp3 streams
osv · CVE-2026-115391 · GHSA-x84v-gj2h-g759
crates.io: wasmtime
Filesystem sandbox escape when paths or symlinks contain trailing slashes
osv · CVE-2026-115392 · GHSA-vqjp-4c8c-hfgg
crates.io: wasmtime
Outgoing HTTP body write allows guest-driven host memory exhaustion
osv · CVE-2026-115388 · GHSA-c9gc-w9vx-w86p
crates.io: wasmtime-wasi-http
Guest can panic host through filesystem datetime overflow
osv · CVE-2026-115387 · GHSA-j2g9-4prp-pf6h
crates.io: wasmtime-wasi
`call_ref` and exception `catch` can drop some fuel accounting, leading to exponential fuel amplification
osv · CVE-2026-115390 · GHSA-m63x-6p34-q65x
crates.io: wasmtime
Dynamic record lifting can allocate beyond the hostcall fuel limit
osv · CVE-2026-115389 · GHSA-jqpg-j7w6-42pr
crates.io: wasmtime
Wasmtime wasi:http implementation panics with a zero timeout supplied
osv · CVE-2026-115382 · GHSA-w4qr-p94g-mjhv
crates.io: wasmtime-wasi-http
WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption
osv · CVE-2026-115380 · GHSA-j366-h8gg-77pm
crates.io: wasmtime-wasi
Excessive allocated memory on the host when guests don't have stdio
osv · CVE-2026-115381 · GHSA-gqmc-89g8-p25r
crates.io: wasmtime-wasi
fd_readdir copies uninitialized struct padding into guest memory
osv · CVE-2026-115386 · GHSA-96f6-r43r-8c24
crates.io: wasmtime-wasi
Guest can panic host through filesystem timestamp before the epoch on wasip3
osv · CVE-2026-115385 · GHSA-mr2v-56j5-cmfc
crates.io: wasmtime-wasi
Mis-typed WebAssembly tag imports can lead to GC heap corruption
osv · CVE-2026-115383 · GHSA-cfhf-m2cr-62wj
crates.io: wasmtime
Rooting for GC values live across `try_call` may be missing, causing GC heap corruption
osv · CVE-2026-115379 · GHSA-hw8m-q44c-ggrf
crates.io: wasmtime
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
osv · CVE-2026-115384 · GHSA-32h6-97mm-8q3c
crates.io: wasmtime
Panic lowering a host-created component model stream into a guest that expects a different payload type
osv · CVE-2026-115892 · GHSA-9pvw-hwfg-92h5
crates.io: wasmtime
Bit-packing in Cranelift compiler causes silent overflow and miscompilation
osv · CVE-2026-115889 · GHSA-897f-g5gm-fmxm
crates.io: wasmtime
Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol
cve-program ·
Vendor product: ArubaOS (AOS)
Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8
cve-program ·
Vendor product: ArubaOS (AOS)
Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise
cve-program ·
Vendor product: ArubaOS (AOS)
Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10
cve-program ·
Vendor product: ArubaOS (AOS)
Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)
cve-program ·
Vendor product: ArubaOS (AOS)
Unauthenticated Buffer Overflow allows Remote Code Execution in web interface
cve-program ·
Vendor product: ArubaOS (AOS)
Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution
cve-program ·
Vendor product: ArubaOS (AOS)
Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol
cve-program ·
Vendor product: ArubaOS (AOS)
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS c…
cve-program ·
https://apps.nextcloud.com: richdocumentscode
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …
cve-program ·
Vendor product: Oracle Mobile Field Service
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …
cve-program ·
Vendor product: Oracle Mobile Field Service
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …
cve-program ·
Vendor product: Oracle Mobile Field Service
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …
cve-program ·
Vendor product: Oracle Mobile Field Service
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …
cve-program ·
Vendor product: Oracle Mobile Field Service
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …
cve-program ·
Vendor product: Oracle Mobile Field Service
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…
cve-program ·
Vendor product: Oracle Mobile Field Service
Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8
cve-program ·
Vendor product: ArubaOS (AOS)
Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8
cve-program ·
Vendor product: ArubaOS (AOS)
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with networ…
cve-program ·
Vendor product: Oracle Engineering
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileg…
cve-program ·
Vendor product: Oracle E-Business Suite Integrated SOA Gateway
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileg…
cve-program ·
Vendor product: Oracle E-Business Suite Integrated SOA Gateway
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.