CVE-2026-112406Published
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
cve-program ·
Vendor product: Pillow
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694539 source statements · aliases may refer to the same vulnerabilityCVE-2026-112895Published
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
cve-program ·
Vendor product: Pillow
CVE-2026-112148Published
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint wh…
cve-program ·
Vendor product: LIFF SDK
CVE-2026-64610Published
Apache Kylin: Redis unsafe Java deserialization
cve-program ·
Vendor product: Apache Kylin
CVE-2026-112901Published
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes
cve-program ·
Vendor product: Pillow
CVE-2026-112372Published
H3C Magic NX15 upload importprofile path traversal
cve-program ·
Vendor product: Magic NX15
CVE-2025-36069Published
TS4500 Tape Library Insufficient Session Expiration
cve-program ·
Vendor product: Storage TS4500 Library
CVE-2026-109442Published
piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell
cve-program ·
Vendor product: piflow
CVE-2026-110095Published
fast-uri vulnerable to improper path equivalence in relative reference normalization
cve-program ·
Vendor product: fast-uri
CVE-2026-77936Published
Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access
cve-program ·
https://pypi.org: letta
CVE-2026-93300Published
EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
cve-program ·
Vendor product: EventON - Subscriber
CVE-2026-111844Published
WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: brizy
CVE-2026-113382Published
arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload
cve-program ·
Vendor product: fast-tunnel
CVE-2026-112785Published
OpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints
cve-program ·
Vendor product: OpenCATS
CVE-2026-110180Published
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
cve-program ·
Vendor product: fast-uri
CVE-2026-113351Published
libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset
cve-program ·
Vendor product: libexpat
CVE-2026-113356Published
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
cve-program ·
Vendor product: DokuWiki
CVE-2026-113388Published
opensource-socialnetwork Cache Settings dynamic.php input code injection
cve-program ·
Vendor product: opensource-socialnetwork
CVE-2026-113392Published
DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal
cve-program ·
Vendor product: Vigor2960
CVE-2026-113396Published
DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection
cve-program ·
Vendor product: Vigor2960
CVE-2026-43846Published
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43847Published
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43845Published
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43848Published
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43849Published
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43850Published
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43851Published
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43853Published
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43844Published
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43839Published
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43837Published
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-112405Published
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
cve-program ·
Vendor product: Pillow
CVE-2026-101201Published
QBinaryJson::fromBinaryData() integer overflow leading to OOB read
cve-program ·
Vendor product: qt
CVE-2026-11960Published
Multiple vulnerabilities in FacturaScripts
cve-program ·
Vendor product: FacturaScripts
CVE-2026-11959Published
Multiple vulnerabilities in FacturaScripts
cve-program ·
Vendor product: FacturaScripts
CVE-2026-113465Published
Possible DOM XSS in SNS Web Administration Portal
cve-program ·
Vendor product: Stormshield Network Security
CVE-2026-43836Published
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-113391Published
DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
cve-program ·
Vendor product: Vigor2960
CVE-2026-43835Published
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43857Published
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-113395Published
DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal
cve-program ·
Vendor product: Vigor2960
CVE-2026-43858Published
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-112070Published
Broken Access Control in extension "Analytics" (analytics)
cve-program ·
https://packagist.org/: t3g/analytics
CVE-2026-113459Published
Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
cve-program ·
https://packagist.org/: nitsan/ns-t3ai
CVE-2026-112239Published
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
cve-program ·
https://packagist.org/: nitsan/ns-t3ai
CVE-2026-113468Published
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
cve-program ·
https://packagist.org/: codingms/shop
CVE-2026-112071Published
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
cve-program ·
https://packagist.org/: codingms/shop
CVE-2026-112238Published
SQL Injection in extension "File manager" (ameos_filemanager)
cve-program ·
https://packagist.org/: ameos/ameos_filemanager
CVE-2026-113442Published
Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
cve-program ·
https://packagist.org/: codingms/fluid-form
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.