CVE-2026-111916Published
Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
cve-program ·
Vendor product: admidio
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694495 source statements · aliases may refer to the same vulnerabilityCVE-2026-111910Published
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
cve-program ·
Vendor product: phpMyFAQ · Vendor product: phpMyFAQ
CVE-2026-111905Published
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data
cve-program ·
Vendor product: phpMyFAQ · Vendor product: phpMyFAQ
CVE-2026-111900Published
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php
cve-program ·
Vendor product: phpMyFAQ · Vendor product: phpMyFAQ
CVE-2026-111894Published
phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI
cve-program ·
Vendor product: phpMyFAQ · Vendor product: phpMyFAQ
CVE-2024-58398Published
Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
cve-program ·
Vendor product: coder · Vendor product: coder · Vendor product: coder
CVE-2026-111855Published
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to rea…
cve-program ·
Vendor product: 3 Series MDO
CVE-2026-108372Published
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
cve-program ·
Vendor product: loopx
CVE-2026-55796Published
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
cve-program ·
Vendor product: hrms
CVE-2026-96620Published
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
cve-program ·
Vendor product: claude-agent-sdk-python
CVE-2026-59970Published
Tandoor Recipes: Blind SSRF via AI provider URL (api_base)
cve-program ·
Vendor product: recipes
CVE-2026-17073Published
IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
cve-program ·
Vendor product: i
CVE-2026-111719Published
Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query
cve-program ·
Vendor product: roncoo-pay
CVE-2026-111714Published
tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
cve-program ·
Vendor product: tarteaucitron.js
CVE-2026-111709Published
WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
cve-program ·
Vendor product: whaticket-community
CVE-2026-111704Published
LangChat through commit 2a6285a Missing Authentication on REST API Controllers
cve-program ·
Vendor product: langchat
CVE-2026-111699Published
Niefy wx-api through 0.8.2 Authentication Bypass via Unverified openid Cookie
cve-program ·
Vendor product: wx-api
CVE-2026-111694Published
qKnow through 2.4.3 Missing Authentication via /flyflow Workflow Endpoints
cve-program ·
Vendor product: qKnow
CVE-2026-111689Published
XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint
cve-program ·
Vendor product: xboot
CVE-2026-101379Published
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Da…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101634Published
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker…
cve-program ·
Vendor product: Oracle Mobile Field Service
CVE-2026-101640Published
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access v…
cve-program ·
Vendor product: Oracle Marketing
CVE-2026-101660Published
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with netwo…
cve-program ·
Vendor product: Oracle Mobile Field Service
CVE-2026-101668Published
Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with n…
cve-program ·
Vendor product: Oracle Customer Care
CVE-2026-101669Published
Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged…
cve-program ·
Vendor product: Oracle Public Sector Human Resources
CVE-2026-101670Published
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with netwo…
cve-program ·
Vendor product: Oracle Email Center
CVE-2026-101671Published
Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with netw…
cve-program ·
Vendor product: Oracle Email Center
CVE-2026-101673Published
Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged att…
cve-program ·
Vendor product: Oracle US Federal Human Resources
CVE-2026-101674Published
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker…
cve-program ·
Vendor product: Oracle Mobile Field Service
CVE-2026-101675Published
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker…
cve-program ·
Vendor product: Oracle Mobile Field Service
CVE-2026-101677Published
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple pr…
cve-program ·
Vendor product: MySQL Connectors
CVE-2026-101678Published
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple pr…
cve-program ·
Vendor product: MySQL Connectors
CVE-2026-101680Published
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exp…
cve-program ·
Vendor product: Oracle Communications Billing and Revenue Management
CVE-2026-101681Published
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to th…
cve-program ·
Vendor product: Applications DBA
CVE-2026-101683Published
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to th…
cve-program ·
Vendor product: Applications DBA
CVE-2026-111684Published
Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service
cve-program ·
Vendor product: magistrala
CVE-2026-101687Published
Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privil…
cve-program ·
Vendor product: Oracle E-Business Suite Integrated SOA Gateway
CVE-2026-111679Published
Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips
cve-program ·
Vendor product: ekko-studio
CVE-2026-111674Published
Tbed through 20240319 Missing Authorization via setImgFileName Endpoint
cve-program ·
Vendor product: Tbed
CVE-2026-111669Published
ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY
cve-program ·
Vendor product: Zr.Admin.NET
CVE-2026-111664Published
Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url
cve-program ·
Vendor product: portmaster
CVE-2026-111659Published
Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit
cve-program ·
Vendor product: waynboot-mall
CVE-2026-70337Published
Microsoft PowerShell Remote Code Execution Vulnerability
cve-program ·
Vendor product: PowerShell 7.4 · Vendor product: PowerShell 7.5 · Vendor product: PowerShell 7.6
CVE-2026-62800Published
Windows SMBv3 Server Remote Code Execution Vulnerability
cve-program ·
Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2
CVE-2026-111654Published
FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints
cve-program ·
Vendor product: FastBee
CVE-2026-70344Published
Windows Installer Elevation of Privilege Vulnerability
cve-program ·
Vendor product: Windows 10 Version 1607 · Vendor product: Windows 10 Version 1809 · Vendor product: Windows 10 Version 21H2
CVE-2026-66804Published
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability
cve-program ·
Vendor product: Windows 10 Version 22H2 · Vendor product: Windows 11 Version 24H2 · Vendor product: Windows 11 Version 25H2
CVE-2026-111649Published
Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint
cve-program ·
Vendor product: paopao-ce
CVE-2026-111644Published
Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes
cve-program ·
Vendor product: misaka_danmu_server
CVE-2026-111639Published
bbs-go through 4.4.6 Account Takeover via Google One Tap Login
cve-program ·
Vendor product: bbs-go
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.