CVE-2026-110773Published
GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint
cve-program ·
https://github.com/growchief/growchief: growchief
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694539 source statements · aliases may refer to the same vulnerabilityCVE-2026-110768Published
holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
cve-program ·
https://github.com/holaboss-ai/holaOS: holaOS
CVE-2026-110763Published
lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany
cve-program ·
https://github.com/zuihou/lamp-boot: lamp-boot
CVE-2026-102756Published
DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting
cve-program ·
Vendor product: dataease
CVE-2026-100406Published
dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`
cve-program ·
Vendor product: dbt-core
CVE-2026-73260Published
Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
cve-program ·
Vendor product: mongoose
CVE-2026-103043Published
anchorme through 3.0.8 Regular Expression Denial of Service
cve-program ·
Vendor product: anchorme
CVE-2026-55167Published
LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session
cve-program ·
Vendor product: lam
CVE-2026-54554Published
FOG adInfo endpoint is reported to disclose the Active Directory join password
cve-program ·
Vendor product: fogproject
CVE-2026-81029Published
OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI
cve-program ·
https://github.com/open-metadata/OpenMetadata: OpenMetadata
CVE-2026-109527Published
Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
cve-program ·
Vendor product: python-sdk
CVE-2026-92150Published
F´: GenericHub Malformed Buffer Assertion DoS
cve-program ·
Vendor product: fprime
CVE-2026-92157Published
F´: FileDownlink SendPartial integer overflow lets legal startOffset/length values reach a reachable assertion
cve-program ·
Vendor product: fprime
CVE-2016-15060Published
PCMan FTP Server PORT buffer overflow
cve-program ·
Vendor product: FTP Server
CVE-2026-77524Published
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
cve-program ·
Vendor product: keda
CVE-2026-102695Published
OmniFaces: Forged combined-resource IDs and related output/push boundaries
cve-program ·
Vendor product: omnifaces
CVE-2026-110735Published
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit inte…
cve-program ·
Vendor product: Godot Engine
CVE-2026-91157Published
Discourse: Media uploads remain publicly accessible after category permissions are restricted
cve-program ·
Vendor product: discourse
CVE-2026-91159Published
Discourse: Stored oEmbed HTML injection via allowed iframe
cve-program ·
Vendor product: discourse
CVE-2026-101896Published
Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
cve-program ·
Vendor product: angular · Vendor product: router
CVE-2026-110719Published
Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header
cve-program ·
https://www.npmjs.com: gateway
CVE-2026-110714Published
libsmb2 through 6.2 Heap Out-of-Bounds Read via decode_acl Integer Underflow
cve-program ·
https://github.com/sahlberg/libsmb2: libsmb2
CVE-2026-110659Published
ELFIO through 3.12 NULL Pointer Dereference via relocation_section_accessor get_entry
cve-program ·
https://github.com/serge1/ELFIO: ELFIO
CVE-2026-110654Published
libzvbi through 0.2.45 Out-of-Bounds Write via Teletext DRCS convert_drcs
cve-program ·
https://github.com/zapping-vbi/zvbi: libzvbi
CVE-2026-110646Published
Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()
cve-program ·
https://packagist.org: snappdf
CVE-2026-110641Published
@runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name
cve-program ·
https://registry.npmjs.org: @runnerty/executor-decompress
CVE-2026-110636Published
pypdftk through 0.5 OS Command Injection via PDF and Output Paths
cve-program ·
https://pypi.org: pypdftk
CVE-2026-110631Published
Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration
cve-program ·
Vendor product: komodo
CVE-2026-110626Published
ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php
cve-program ·
https://github.com: clipbucket-v5
CVE-2026-110621Published
Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId
cve-program ·
https://github.com/Swetrix/swetrix: swetrix
CVE-2026-110616Published
NullHub through 2026.5.29 Missing Authentication for /api Management API
cve-program ·
Vendor product: NullHub
CVE-2026-110611Published
REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid
cve-program ·
https://github.com: rebuild
CVE-2026-110606Published
LibreCAD libdxfrw through LC2.2.0 Stack Out-of-Bounds Read via dwgReader18::readFileHeader
cve-program ·
https://github.com/LibreCAD/libdxfrw: libdxfrw · Vendor product: LibreCAD
CVE-2026-110601Published
libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 Heap Out-of-Bounds Write via GIF
cve-program ·
https://github.com: libsixel
CVE-2026-110596Published
quirc through 1.2 Denial of Service via find_alignment_pattern Spiral Search
cve-program ·
Vendor product: quirc
CVE-2026-110591Published
OW2 ASM 1.4.3 before 9.11 Excessive Resource Consumption via Analyzer
cve-program ·
https://repo1.maven.org/maven2/: ASM
CVE-2026-110260Published
OW2 ASM 3.0 before 9.11 Quadratic Memory Allocation via Exception Handlers
cve-program ·
https://repo1.maven.org/maven2/: ASM
CVE-2024-58392Published
PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint
cve-program ·
https://github.com/icculus/physfs: PhysicsFS
GHSA-5wf9-h793-w73cPublished
Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks
osv · GO-2026-6651
Go: github.com/xtls/xray-core
GHSA-r3rm-qphw-hh76Published
Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling
osv · CVE-2026-41508 · GO-2026-6670
Go: github.com/corazawaf/coraza/v3
GHSA-f46q-3v67-fmm4Published
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query
osv · CVE-2026-62251 · GO-2026-6672
Go: github.com/sipcapture/homer-app
GHSA-6r3q-mjv7-xr8mPublished
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
osv · CVE-2026-41510 · GO-2026-6668
Go: github.com/corazawaf/coraza/v3
GHSA-rqcc-94gv-wjm9Published
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)
osv · CVE-2026-62253 · GO-2026-6673
Go: github.com/sipcapture/homer-app
GHSA-q7hv-xx6h-q2x8Published
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
osv · CVE-2026-26287 · GO-2026-6667
Go: github.com/external-secrets/external-secrets
GHSA-6xp5-7rcx-xfgxPublished
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login
osv · CVE-2026-62252 · GO-2026-6671
Go: github.com/sipcapture/homer-app
GO-2026-6668Published
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding in github.com/corazawaf/coraza
osv · CVE-2026-41510 · GHSA-6r3q-mjv7-xr8m
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
GO-2026-6672Published
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query in github.com/sipcapture/homer-app
osv · CVE-2026-62251 · GHSA-f46q-3v67-fmm4
Go: github.com/sipcapture/homer-app
GO-2026-6673Published
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) in github.com/sipcapture/homer-app
osv · CVE-2026-62253 · GHSA-rqcc-94gv-wjm9
Go: github.com/sipcapture/homer-app
GO-2026-6671Published
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login in github.com/sipcapture/homer-app
osv · CVE-2026-62252 · GHSA-6xp5-7rcx-xfgx
Go: github.com/sipcapture/homer-app
GO-2026-6670Published
Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling in github.com/corazawaf/coraza
osv · CVE-2026-41508 · GHSA-r3rm-qphw-hh76
Go: github.com/corazawaf/coraza · Go: github.com/corazawaf/coraza/v2 · Go: github.com/corazawaf/coraza/v3
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.