CVE-2026-113383Published
Optimal IdM OptimalCloud Login cross site scripting
cve-program ·
Vendor product: OptimalCloud
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694539 source statements · aliases may refer to the same vulnerabilityCVE-2026-113389Published
DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
cve-program ·
Vendor product: Vigor2960
CVE-2026-113393Published
DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload
cve-program ·
Vendor product: Vigor2960
CVE-2026-77935Published
Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
cve-program ·
Vendor product: coze-studio
CVE-2026-113381Published
Osclass Item Model Item.php findUserItems sql injection
cve-program ·
Vendor product: Osclass
CVE-2026-112784Published
OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php
cve-program ·
Vendor product: OpenCATS
CVE-2026-113350Published
react-admin before 5.15.5 Stored XSS via UrlField and FileField
cve-program ·
Vendor product: react-admin
CVE-2026-113355Published
Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
cve-program ·
Vendor product: chatwoot
CVE-2026-113385Published
LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components
cve-program ·
Vendor product: Shortcutter 2 App
CVE-2026-80726Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
cve-program ·
CVE-2026-18551Published
Mattermost guest account privilege escalation via member roles API
cve-program ·
Vendor product: Mattermost
CVE-2026-79985Published
Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-smb
CVE-2026-79984Published
Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-mina-sftp
CVE-2026-79983Published
Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-ftp
CVE-2026-78165Published
Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-spring-redis
CVE-2026-81452Published
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileg…
cve-program ·
Vendor product: Alienware Command Center (AWCC)
CVE-2026-102917Published
IBM i is Affected By An Improper Privilege Management Vulnerability
cve-program ·
Vendor product: i
CVE-2026-108743Published
Apache Kylin: spark job OS command injection
cve-program ·
Vendor product: Apache Kylin
CVE-2026-12665Published
IBM MQ Buffer Overflow
cve-program ·
Vendor product: MQ Operator · Vendor product: MQ Advanced container images
CVE-2026-12148Published
IBM MQ Deserialization of Untrusted Data
cve-program ·
Vendor product: MQ Operator · Vendor product: MQ Advanced container images
CVE-2026-10574Published
IBM MQ Buffer Overflow
cve-program ·
Vendor product: MQ Operator · Vendor product: MQ Advanced container images
CVE-2026-10572Published
IBM MQ Buffer Overflow
cve-program ·
Vendor product: MQ Operator · Vendor product: MQ Advanced container images
GHSA-rjg6-39jm-rgg4Published
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
osv · CVE-2026-67330
npm: @better-auth/scim · npm: @better-auth/scim
GHSA-fmxq-cgp8-87wpPublished
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
osv · BIT-argo-cd-2026-77459 · CVE-2026-77459 · GO-2026-6784
Go: github.com/argoproj/argo-cd/v2 · Go: github.com/argoproj/argo-cd/v3 · Go: github.com/argoproj/argo-cd/v3
GO-2026-6784Published
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd
osv · BIT-argo-cd-2026-77459 · CVE-2026-77459 · GHSA-fmxq-cgp8-87wp
Go: github.com/argoproj/argo-cd · Go: github.com/argoproj/argo-cd/v2 · Go: github.com/argoproj/argo-cd/v3
CVE-2025-49300Published
WordPress Traveler Option Tree plugin <= 2.8 - Sensitive Data Exposure vulnerability
cve-program ·
https://themeforest.net: custom-option-tree
RUSTSEC-2026-0262Published
`append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency
osv ·
crates.io: append-only-vec
GHSA-36rh-ggpr-j3gjPublished
Renovate vulnerable to Azure DevOps token leakage in logs
osv · CVE-2020-37267
npm: renovate
GHSA-v7x3-7hw7-pcjgPublished
Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments
osv · CVE-2019-25766
npm: renovate
CVE-2026-111283Published
BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration
cve-program ·
Vendor product: BMC Helix Network Management
GO-2026-5038Published
Quadratic complexity in WordDecoder.DecodeHeader in mime
osv · BIT-golang-2026-42504 · CVE-2026-42504
Go: stdlib
GO-2026-6091Published
Fix Javascript regexp context tracking in html/template
osv · BIT-golang-2026-56858 · CVE-2026-56858
Go: stdlib
GO-2026-5972Published
Enforce maximum recursion depth in encoding/asn1
osv · BIT-golang-2026-33818 · CVE-2026-33818
Go: stdlib
GO-2026-6088Published
Add recursion depth guard during decode in encoding/xml
osv · BIT-golang-2026-56859 · CVE-2026-56859
Go: stdlib
GO-2026-6090Published
Limit handshake messages we are willing to accept post-handshake in crypto/tls
osv · BIT-golang-2026-56862 · CVE-2026-56862
Go: stdlib
GO-2026-6629Published
Panic parsing crafted input in x/text/secure/precis in golang.org/x/text
osv · CVE-2026-56851
Go: golang.org/x/text
GO-2026-6218Published
Avoid quadratic complexity in resolvePath in net/url
osv · BIT-golang-2026-56860 · CVE-2026-56860
Go: stdlib
CVE-2025-54821Published
An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, Fort…
cve-program ·
Vendor product: FortiOS · Vendor product: FortiProxy · Vendor product: FortiPAM
CVE-2026-43833Published
A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43831Published
A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code execution.
cve-program ·
Vendor product: ADAM-3600
CVE-2026-43830Published
A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.
cve-program ·
Vendor product: ADAM-3600
CVE-2025-14969Published
Hibernate-reactive-core: hibernate reactive: denial of service due to connection leak on http client disconnect
cve-program ·
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: org.hibernate.reactive/hibernate-reactive-core · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: hibernate-reactive-core · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: quarkus-hibernate-reactive-panache
CVE-2026-76763Published
Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals
cve-program ·
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: io.smallrye/smallrye-graphql · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: io.smallrye/smallrye-graphql
CVE-2026-12894Published
Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine
cve-program ·
https://repo1.maven.org/maven2: io.quarkus:quarkus-qute · https://access.redhat.com/downloads/content/package-browser/: io.quarkus/quarkus-qute · https://access.redhat.com/jbossnetwork/restricted/listSoftware.html: io.quarkus/quarkus-qute
CVE-2026-9800Published
Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison
cve-program ·
https://catalog.redhat.com/software/containers/: rhbk/keycloak-operator-bundle · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9 · https://catalog.redhat.com/software/containers/: rhbk/keycloak-rhel9-operator
CVE-2026-112248Published
grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal
cve-program ·
Vendor product: grandnode2
CVE-2025-1634Published
Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout
cve-program ·
https://github.com/quarkusio/quarkus: quarkus-resteasy · https://access.redhat.com/downloads/content/package-browser/: quarkus-resteasy · https://access.redhat.com/downloads/content/package-browser/: Red Hat build of Quarkus 3.15.3.SP1
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.