CVE-2024-57975Published
btrfs: do proper folio cleanup when run_delalloc_nocow() failed
cve-program ·
Vendor product: Linux · Vendor product: Linux
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694495 source statements · aliases may refer to the same vulnerabilityCVE-2024-57857Published
RDMA/siw: Remove direct link to net_device
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-57809Published
PCI: imx6: Fix suspend/resume support on i.MX6QDL
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-56702Published
bpf: Mark raw_tp arguments with PTR_MAYBE_NULL
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-56544Published
udmabuf: change folios array from kmalloc to kvmalloc
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-53219Published
virtiofs: use pages instead of pointer for kernel direct IO
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-50043Published
nfsd: fix possible badness in FREE_STATEID
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-49888Published
bpf: Fix a sdiv overflow issue
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-49885Published
mm, slub: avoid zeroing kmalloc redzone
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-46842Published
scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-46682Published
nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-43888Published
mm: list_lru: fix UAF for memory cgroup
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-42317Published
mm/huge_memory: avoid PMD-size page cache if needed
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-42162Published
gve: Account for stopped queues when reading NIC stats
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-42068Published
bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-42067Published
bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2024-41932Published
sched: fix warning in sched_setaffinity
cve-program ·
Vendor product: Linux · Vendor product: Linux
GHSA-vrv5-2jg9-4mmrPublished
Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability
osv · BIT-dotnet-2026-96222 · BIT-dotnet-sdk-2026-96222 · CVE-2026-96222
NuGet: System.Security.Cryptography.Xml
CVE-2026-101765Published
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploit…
cve-program ·
Vendor product: Oracle Communications Billing and Revenue Management
CVE-2026-101808Published
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network acc…
cve-program ·
Vendor product: Oracle Product Workbench
CVE-2026-91490Published
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthentica…
cve-program ·
Vendor product: Oracle Identity Manager Connector
CVE-2026-91624Published
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows un…
cve-program ·
Vendor product: Oracle Agile Product Lifecycle Management for Process
CVE-2026-101499Published
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated atta…
cve-program ·
Vendor product: Oracle WebCenter Sites
CVE-2026-101537Published
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise…
cve-program ·
Vendor product: Oracle Solaris
CVE-2026-101763Published
Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Ea…
cve-program ·
Vendor product: Oracle Communications BRM - Elastic Charging Engine
GHSA-pp95-gc86-jq6qPublished
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
osv ·
npm: trigger.dev
GHSA-c6fg-446q-cg94Published
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
osv · CVE-2026-114103
npm: adm-zip
GHSA-rgj7-g3m4-5g8cPublished
sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545
osv · CVE-2026-114112
npm: sharp
GHSA-wq5f-xc86-pv6wPublished
sharp : Vulnerability in librsvg dependency CVE-2026-96889
osv · CVE-2026-114111
npm: sharp
GHSA-f88m-g3jw-g9cjPublished
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
osv · CVE-2026-114113
npm: sharp
GHSA-fj2x-mqqp-3v2wPublished
Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values
osv · CVE-2026-114073
npm: trigger.dev
GHSA-59h8-w5q6-mfmpPublished
Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId
osv · CVE-2026-114086
npm: trigger.dev
GHSA-4672-hwv6-gq62Published
Trigger.dev: Cross-environment deployment cancel
osv · CVE-2026-114079
npm: trigger.dev
GHSA-9q4r-4842-93vwPublished
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
osv · CVE-2026-114081
npm: trigger.dev
GHSA-pqxw-g93w-hj9xPublished
Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise
osv · CVE-2026-114087
npm: trigger.dev
GHSA-p634-w6r4-rjp2Published
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
osv · CVE-2026-114104
npm: adm-zip
GHSA-q567-cr4x-96w4Published
Trigger.dev: Blind SSRF via alert-channel webhook
osv · CVE-2026-114076
npm: trigger.dev
GHSA-4gg8-gxpx-9rphPublished
uv is vulnerable to arbitrary file write through entry point names
osv · CVE-2026-114109
PyPI: uv · crates.io: uv
GHSA-8238-w5pm-2374Published
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
osv · CVE-2026-114102
npm: adm-zip
GHSA-gg6r-gp4c-89hpPublished
Trigger.dev: V1 coordinator default-secret unauth Socket.IO
osv · CVE-2026-114088
npm: trigger.dev
GHSA-5gj4-9gm7-2fx2Published
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection
osv · CVE-2026-114099 · GO-2026-6692
Go: github.com/corazawaf/coraza/v3
GO-2026-6692Published
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza
osv · CVE-2026-114099 · GHSA-5gj4-9gm7-2fx2
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GHSA-3wr7-993q-jrffPublished
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules
osv · CVE-2026-114101 · GO-2026-6691
Go: github.com/corazawaf/coraza/v3
GO-2026-6691Published
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/coraza
osv · CVE-2026-114101 · GHSA-3wr7-993q-jrff
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GHSA-w253-m66g-rx24Published
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection
osv · CVE-2026-114100 · GO-2026-6698
Go: github.com/corazawaf/coraza/v3
GO-2026-6698Published
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/coraza
osv · CVE-2026-114100 · GHSA-w253-m66g-rx24
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
CVE-2026-101767Published
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with net…
cve-program ·
Vendor product: Oracle Application Object Library
CVE-2026-60432Published
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network acces…
cve-program ·
Vendor product: Oracle Solaris
CVE-2026-83396Published
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauth…
cve-program ·
Vendor product: Oracle Data Integrator
CVE-2026-83397Published
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauth…
cve-program ·
Vendor product: Oracle Data Integrator
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.