CVE-2026-20327Published
Cisco Unified Intelligence Center SQL Injection Vulnerability
cve-program ·
Vendor product: Cisco Unified Intelligence Center
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694538 source statements · aliases may refer to the same vulnerabilityCVE-2026-78497Published
JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval
cve-program ·
https://cpan.org/modules: JQ-Lite
CVE-2026-113671Published
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
cve-program ·
Vendor product: apostrophe · Vendor product: ai-helper
CVE-2026-8596Published
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path
cve-program ·
Vendor product: Amazon SageMaker Python SDK
CVE-2026-6437Published
AWS EFS CSI Driver Mount Option Injection
cve-program ·
Vendor product: AWS EFS CSI Driver
CVE-2026-112161Published
Lack of integrity checks in Mobatek’s MobaXterm
cve-program ·
Vendor product: MobaXterm
CVE-2026-113610Published
Xen Orchestra before 6.9.0 Authorization Bypass via user.set API
cve-program ·
Vendor product: xen-orchestra
CVE-2026-35562Published
Allocation of resources without limits in parsing components in Amazon Athena ODBC driver
cve-program ·
Vendor product: Amazon Athena ODBC driver
CVE-2026-35560Published
Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver
cve-program ·
Vendor product: Amazon Athena ODBC driver
CVE-2026-35559Published
Out-of-bounds write in query processing components in Amazon Athena ODBC driver
cve-program ·
Vendor product: Amazon Athena ODBC driver
CVE-2026-35558Published
Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver
cve-program ·
Vendor product: Amazon Athena ODBC driver
CVE-2026-101356Published
Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
cve-program ·
Vendor product: Apache Tomcat
CVE-2026-5485Published
OS command injection in Amazon Athena ODBC driver on Linux
cve-program ·
Vendor product: Amazon Athena ODBC driver
CVE-2026-5190Published
AWS C Event Stream Streaming Decoder Stack Buffer Overflow
cve-program ·
Vendor product: aws-c-event-stream
CVE-2026-104679Published
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitive…
cve-program ·
Vendor product: VOCALOID6 Editor
CVE-2026-35561Published
Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver
cve-program ·
Vendor product: Amazon Athena ODBC driver
CVE-2026-110754Published
Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline
cve-program ·
https://cpan.org/modules: Text-CSV_XS
GHSA-qhcq-9pm2-c9w9Published
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
osv · CVE-2026-113658
npm: apostrophe
GHSA-44qr-rrjg-2cqqPublished
ApostropheCMS: CAPTCHA response token not URL-encoded
osv · CVE-2026-113667
npm: @apostrophecms/form · npm: @apostrophecms/login-recaptcha · npm: @apostrophecms/login-hcaptcha
GHSA-q3jh-wrc6-jgq8Published
follow-redirects array-form headers bypass cross-origin credential stripping
osv · CVE-2026-111756
npm: follow-redirects
GHSA-89mh-mm8c-mv7fPublished
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
osv · CVE-2026-113656
npm: @apostrophecms/form
GHSA-hhvr-8m24-qqr3Published
ApostropheCMS: Cross-domain session token in URL confers session takeover
osv · CVE-2026-113669
npm: apostrophe · npm: @apostrophecms/passport-bridge
GHSA-j5rq-xfvr-p969Published
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
osv · CVE-2026-113666
npm: @apostrophecms/db-connect · npm: apostrophe
GHSA-2jrp-qc93-h2j8Published
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
osv · CVE-2026-113655
npm: apostrophe
GHSA-x3q4-9hxx-gx8mPublished
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
osv · CVE-2026-113654
npm: sanitize-html
CVE-2026-8178Published
Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
cve-program ·
https://github.com/aws/amazon-redshift-jdbc-driver: Amazon Redshift JDBC Driver
CVE-2026-110753Published
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
cve-program ·
https://cpan.org/modules: Text-CSV_XS
CVE-2026-11400Published
Privilege Escalation in AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL
cve-program ·
Vendor product: AWS Advanced JDBC Wrapper
CVE-2026-110752Published
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment
cve-program ·
https://cpan.org/modules: Text-CSV_XS
CVE-2026-86830Published
Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
cve-program ·
Vendor product: iam-identity-center-team
CVE-2026-94450Published
Potential denial of service when configured to send Retry packets in s2n-quic
cve-program ·
Vendor product: s2n-quic
CVE-2026-15957Published
Uncontrolled recursion in smithy-rs generated JSON, CBOR, and XML deserializers allows unauthenticated remote denial of service via recursive shapes
cve-program ·
Vendor product: aws-sdk-rust
CVE-2026-113677Published
Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
cve-program ·
Vendor product: froxlor
CVE-2026-108096Published
Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
cve-program ·
Vendor product: aws-amplify/graphql-index-transformer · Vendor product: aws-amplify/graphql-api-construct · Vendor product: aws-amplify/data-construct
CVE-2026-90800Published
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
cve-program ·
Vendor product: Apache CouchDB
CVE-2026-90799Published
Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
cve-program ·
Vendor product: Apache CouchDB
CVE-2026-90798Published
Apache CouchDB: Replicator follows redirects indefinitely
cve-program ·
Vendor product: Apache CouchDB
CVE-2026-90797Published
Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
cve-program ·
Vendor product: Apache CouchDB
CVE-2026-108089Published
Apache Cocoon: Unauthenticated access to diagnostic interfaces
cve-program ·
Vendor product: Apache Cocoon
CVE-2026-107755Published
Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
cve-program ·
Vendor product: Apache CouchDB
CVE-2026-103119Published
Apache Tomcat: AJP response mix-up
cve-program ·
Vendor product: Apache Tomcat
CVE-2026-10591Published
Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
cve-program ·
Vendor product: Kiro IDE
CVE-2026-109588Published
Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel
cve-program ·
Vendor product: FreeRTOS-Kernel
CVE-2026-68498Published
jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service
cve-program ·
https://repo.maven.apache.org/maven2: com.fasterxml.jackson.core:jackson-core · https://repo.maven.apache.org/maven2: tools.jackson.core:jackson-core
CVE-2026-113403Published
ArmorX Global Technology｜ArmorX Spam - Command Injection
cve-program ·
Vendor product: ArmorX Spam
CVE-2026-113407Published
YS-infoware｜BA-Workflow - SQL Injection
cve-program ·
Vendor product: BA-Workflow
CVE-2026-113469Published
Improper Signature Verification of Active Update Files
cve-program ·
Vendor product: Stormshield Network Security
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.