CVE-2026-111634Published
Helical Insight through 7.0.0 SQL Injection via /executeDatasource
cve-program ·
Vendor product: helicalinsight
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694495 source statements · aliases may refer to the same vulnerabilityCVE-2026-111629Published
IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
cve-program ·
Vendor product: IoTSharp
CVE-2026-111624Published
Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
cve-program ·
Vendor product: Umbraco-CMS
CVE-2026-111619Published
FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
cve-program ·
Vendor product: FilePress
CVE-2026-111614Published
DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials
cve-program ·
Vendor product: DataCap
CVE-2026-17113Published
Cri-o: cri-o: unvalidated image env var causes daemon crash
cve-program ·
https://github.com/cri-o/cri-o: cri-o · https://access.redhat.com/downloads/content/package-browser/: cri-o · https://access.redhat.com/downloads/content/package-browser/: openshift/ose-rhel-coreos-8
CVE-2026-114117Published
Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches
cve-program ·
Vendor product: vyper
CVE-2026-114391Published
ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
cve-program ·
Vendor product: zentaopms
CVE-2026-114396Published
Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
cve-program ·
Vendor product: trudesk
GHSA-xp26-3454-mjgpPublished
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
osv · CVE-2026-112950
npm: @vitest/mocker · npm: @vitest/mocker
GHSA-qxg6-89mg-rqv8Published
Vitest: Code injection via unauthenticated manual mock registration
osv · CVE-2026-112949
npm: @vitest/mocker · npm: @vitest/mocker
GHSA-p458-7748-mcp3Published
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
osv · CVE-2026-112948
npm: @vitest/ui · npm: @vitest/browser · npm: vite-plus
GHSA-5gc8-frw3-3vqmPublished
ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
osv · CVE-2026-112953
npm: @apostrophecms/import-export
CVE-2026-114401Published
Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
cve-program ·
Vendor product: trudesk
CVE-2026-114386Published
Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code
cve-program ·
Vendor product: pydantic-ai-harness
CVE-2026-53986Published
Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure
cve-program ·
Vendor product: Girafit camera app
CVE-2026-114493Published
LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
cve-program ·
Vendor product: LocalAI
GHSA-3x84-qq85-fj65Published
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
osv · CVE-2026-62197
npm: openclaw
GHSA-jw7v-5mp7-ghgmWithdrawn
Duplicate Advisory: Browser CDP discovery could accept blocked WebSocket URLs
osv ·
npm: openclaw
CVE-2026-94416Published
Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: automation-gateway · https://catalog.redhat.com/software/containers/: ansible-automation-platform-27/gateway-rhel9 · https://access.redhat.com/downloads/content/package-browser/: ansible-automation-platform-25/gateway-rhel8
CVE-2026-113470Published
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component
cve-program ·
Vendor product: Firefox · Vendor product: Thunderbird
CVE-2026-93856Published
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-…
cve-program ·
Vendor product: Cinder
CVE-2026-101464Published
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to t…
cve-program ·
Vendor product: Siebel CRM Deployment
CVE-2026-101373Published
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST D…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101374Published
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compro…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101375Published
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Or…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101376Published
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise O…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101377Published
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise O…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101378Published
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Dat…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101380Published
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Dat…
cve-program ·
Vendor product: Oracle REST Data Services
CVE-2026-101618Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
CVE-2026-101619Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
CVE-2026-101620Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 9.7.0-9.7.3; MySQL Cluster: 9.7.0-9.7.3. Easily exploitable vulnerability allow…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
CVE-2026-101621Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
CVE-2026-101622Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
CVE-2026-101623Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
CVE-2026-101624Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
CVE-2026-101625Published
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple …
cve-program ·
Vendor product: MySQL Connectors
CVE-2026-101626Published
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl…
cve-program ·
Vendor product: MySQL Connectors
CVE-2026-101465Published
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to…
cve-program ·
Vendor product: Siebel CRM Deployment
CVE-2026-101627Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
CVE-2026-101628Published
Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator). The supported version that is affected is 9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP t…
cve-program ·
Vendor product: MySQL Cluster
CVE-2026-101629Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploita…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
CVE-2026-101630Published
Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged at…
cve-program ·
Vendor product: Oracle Advanced Outbound Telephony
CVE-2026-101631Published
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to …
cve-program ·
Vendor product: MySQL Router
CVE-2026-101632Published
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to co…
cve-program ·
Vendor product: MySQL Router
CVE-2026-101633Published
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to com…
cve-program ·
Vendor product: MySQL Router
CVE-2026-101636Published
Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with net…
cve-program ·
Vendor product: Oracle Mobile Field Service
CVE-2026-101637Published
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB). Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploita…
cve-program ·
Vendor product: MySQL Server · Vendor product: MySQL Cluster
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.