CVE-2026-113711Published
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
cve-program ·
Vendor product: apostrophe · Vendor product: import-export
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694538 source statements · aliases may refer to the same vulnerabilityCVE-2026-111767Published
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
cve-program ·
Vendor product: typescript-sdk
CVE-2026-71563Published
Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
cve-program ·
Vendor product: Apache Answer
MAL-2026-18105Published
Malicious code in @securihackbot/depconf-stage-1792484738 (npm)
osv ·
npm: @securihackbot/depconf-stage-1792484738
MAL-2026-18109Published
Malicious code in rs-lookout-sandbox-poc (npm)
osv ·
npm: rs-lookout-sandbox-poc
CVE-2026-64943Published
Apache Answer: API keys logged in plaintext during authentication
cve-program ·
Vendor product: Apache Answer
CVE-2023-43661Published
Cachet vulnerable to Authenticated Remote Code Execution
cve-program ·
Vendor product: cachet
CVE-2026-7791Published
Local Privilege Escalation via TOCTOU Race Condition in Amazon WorkSpaces Skylight Agent
cve-program ·
Vendor product: Workspaces
CVE-2026-113808Published
Stored XSS on SNS Enrollment Portal
cve-program ·
Vendor product: Stormshield Network Security
CVE-2026-113810Published
Stored XSS on SNS Enrollment Portal
cve-program ·
Vendor product: Stormshield Network Security
CVE-2026-113643Published
EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization
cve-program ·
Vendor product: EspoCRM
GHSA-22jm-h49p-29qwPublished
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
osv · CVE-2026-111767
npm: @modelcontextprotocol/sdk
GHSA-vwwx-px9w-crrcPublished
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
osv · CVE-2026-113665
npm: apostrophe
GHSA-698v-4r3x-3vcvPublished
launch-editor: escapeCmdArgs() omits % escaping on Windows
osv · CVE-2026-112943
npm: launch-editor · npm: vite · npm: vite
GHSA-6prh-2h8m-c8cwPublished
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
osv · CVE-2026-111769
npm: @modelcontextprotocol/sdk · npm: @modelcontextprotocol/client
GHSA-xf6w-q65w-4f2wPublished
ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
osv · CVE-2026-113653
npm: apostrophe
CVE-2026-113708Published
Argo CD: A Kustomize remote ref can run commands in the repo-server
cve-program ·
Vendor product: argo-cd
CVE-2024-4457Published
Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
cve-program ·
Vendor product: WSO2 Enterprise Integrator · Vendor product: WSO2 API Manager · Vendor product: WSO2 Open Banking AM
GHSA-2j32-q6rx-h844Published
ApostropheCMS: Page REST API authorization bypass
osv · CVE-2026-110904 · CVE-2026-113670
npm: apostrophe
CVE-2026-108984Published
GV-ASManager Web Server Buffer Overflow Vulnerability
cve-program ·
Vendor product: GV-ASManager
CVE-2026-110024Published
@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults
cve-program ·
Vendor product: @fastify/jwt
CVE-2026-110759Published
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse
cve-program ·
https://cpan.org/modules: Text-CSV_XS
CVE-2026-110758Published
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace
cve-program ·
https://cpan.org/modules: Text-CSV_XS
GHSA-97wv-p4xx-c7mgPublished
ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
osv · CVE-2026-113664
npm: @apostrophecms/import-export
GHSA-m2m5-rw3w-cwmjPublished
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
osv · CVE-2026-113659
npm: apostrophe
GHSA-653j-g8j7-gh54Published
ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
osv · CVE-2026-113710
npm: apostrophe
GHSA-cv27-6wvh-8x7jPublished
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
osv · CVE-2026-113661
npm: sanitize-html
GHSA-vmxh-77cw-65j7Published
ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
osv · CVE-2026-113660
npm: apostrophe
GHSA-374f-7chj-9948Published
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
osv · CVE-2026-113657
npm: sanitize-html
GHSA-hhph-8536-gfq5Published
ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
osv · CVE-2026-113652
npm: uploadfs
GHSA-527g-ff96-x6wjPublished
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
osv · CVE-2026-113671
npm: @apostrophecms/ai-helper
GHSA-gmfx-5g6x-rr72Published
ApostropheCMS: Path traversal in uploadfs
osv · CVE-2026-113651
npm: uploadfs
GHSA-jqw5-w6h3-44g6Published
ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
osv · CVE-2026-113662
npm: @apostrophecms/import-export
CVE-2026-110757Published
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine
cve-program ·
https://cpan.org/modules: Text-CSV_XS
CVE-2026-110756Published
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
cve-program ·
https://cpan.org/modules: Text-CSV_XS
CVE-2026-6967Published
Missing Delegated Metadata Validation in awslabs/tough
cve-program ·
Vendor product: tough · Vendor product: tuftool
CVE-2026-6968Published
Multiple Path Traversal Variants in awslabs/tough
cve-program ·
Vendor product: tough · Vendor product: tuftool
CVE-2026-110755Published
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline
cve-program ·
https://cpan.org/modules: Text-CSV_XS
CVE-2026-6966Published
Signature Threshold Bypass in awslabs/tough Delegated Roles
cve-program ·
Vendor product: tough · Vendor product: tuftool
CVE-2026-3494Published
MariaDB Server Audit Plugin Comment Handling Bypass
cve-program ·
Vendor product: MariaDB Server · Vendor product: Aurora MySQL · Vendor product: RDS for MySQL
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.