CVE-2026-108794Published
ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection
cve-program ·
Vendor product: BioTime
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694815 source statements · aliases may refer to the same vulnerabilityCVE-2026-111444Published
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and …
cve-program ·
Vendor product: Wheels
CVE-2026-111449Published
Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an u…
cve-program ·
Vendor product: Wheels
CVE-2026-111458Published
ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting
cve-program ·
Vendor product: ssldump
CVE-2026-96659Published
Foreman: excessive permissions for viewer role on preview
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: foreman · https://access.redhat.com/downloads/content/package-browser/: foreman · https://access.redhat.com/downloads/content/package-browser/: foreman
CVE-2026-19541Published
Outgoing OAuth connection client secret exposure during connection validation
cve-program ·
Vendor product: Mattermost
CVE-2026-19600Published
Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts
cve-program ·
Vendor product: Mattermost
CVE-2026-19601Published
Disclosure of AD/LDAP bind password via Test Connection
cve-program ·
Vendor product: Mattermost
CVE-2026-19867Published
Uncapped mention keys in user notification properties allow CPU exhaustion during post processing
cve-program ·
Vendor product: Mattermost
CVE-2026-18795Published
Missing server side validation allowed user to quarantine a DM and GM post
cve-program ·
Vendor product: Mattermost
CVE-2026-19603Published
Private channel ID disclosure via user status endpoints
cve-program ·
Vendor product: Mattermost
CVE-2026-19621Published
Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads
cve-program ·
Vendor product: Mattermost
CVE-2026-18256Published
Private team metadata disclosure via the team search API
cve-program ·
Vendor product: Mattermost
CVE-2026-16251Published
Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering
cve-program ·
Vendor product: Mattermost
CVE-2026-84713Published
Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle
cve-program ·
https://catalog.redhat.com/software/containers/: ansible-automation-platform-27/controller-rhel9 · https://access.redhat.com/downloads/content/package-browser/: ansible-automation-platform-26/controller-rhel9 · https://access.redhat.com/downloads/content/package-browser/: automation-controller
CVE-2026-80158Published
Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: ansible-collection-community-general · https://access.redhat.com/downloads/content/package-browser/: ansible-collection-community-general · https://access.redhat.com/downloads/content/package-browser/: ansible-collection-community-general
CVE-2026-71461Published
Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler
cve-program ·
https://catalog.redhat.com/software/containers/: ansible-automation-platform-27/controller-rhel9 · https://access.redhat.com/downloads/content/package-browser/: ansible-automation-platform-26/controller-rhel9 · https://access.redhat.com/downloads/content/package-browser/: automation-controller
CVE-2026-76648Published
Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery
cve-program ·
https://catalog.redhat.com/software/containers/: ansible-automation-platform-27/controller-rhel9 · https://access.redhat.com/downloads/content/package-browser/: ansible-automation-platform-26/controller-rhel9 · https://access.redhat.com/downloads/content/package-browser/: automation-controller
CVE-2024-8008Published
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
cve-program ·
Vendor product: WSO2 Enterprise Integrator · Vendor product: WSO2 API Manager · Vendor product: WSO2 Identity Server as Key Manager
CVE-2026-110594Published
BottleCRM 0.43 through 1.14.5 ReDoS via Case Routing Rule Regex
cve-program ·
https://pypi.org: BottleCRM
CVE-2026-110593Published
BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail
cve-program ·
https://pypi.org: BottleCRM
CVE-2026-110592Published
BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template
cve-program ·
https://pypi.org: BottleCRM
CVE-2026-107635Published
Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK Datum Size Underflow
cve-program ·
Vendor product: dislocker
CVE-2026-18799Published
Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users
cve-program ·
Vendor product: Mattermost
CVE-2026-14177Published
User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure
cve-program ·
Vendor product: ikas E-Commerce Infrastructure
CVE-2026-27433Published
WordPress Motors theme < 5.6.85 - Broken Access Control vulnerability
cve-program ·
https://themeforest.net: motors
CVE-2026-15575Published
Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier
cve-program ·
Vendor product: Costifier
CVE-2026-101300Published
Server-Side Request Forgery in Wegow PDF export
cve-program ·
Vendor product: Wegow
CVE-2024-0858Published
Innovs HR < 1.0.3.7.1 - Employee Creation via CSRF
cve-program ·
https://wordpress.org/plugins: Innovs HR
CVE-2026-18807Published
ECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers
cve-program ·
Vendor product: ECS
GO-2026-4601Published
Incorrect parsing of IPv6 host literals in net/url
osv · BIT-golang-2026-25679 · CVE-2026-25679
Go: stdlib
GO-2026-4918Published
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
osv · BIT-golang-2026-33814 · CVE-2026-33814
Go: golang.org/x/net · Go: stdlib
GO-2026-5026Published
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
osv · CVE-2026-39821
Go: stdlib · Go: golang.org/x/net
CVE-2026-106030Published
Missing Authorization in NordVPN for Windows
cve-program ·
Vendor product: NordVPN
CVE-2026-14452Published
Open redirect and XSS via reset_url parameter
cve-program ·
Vendor product: Checkmk
CVE-2026-96339Published
WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: houzez
CVE-2025-61662Published
Grub2: missing unregister call for gettext command may lead to use-after-free
cve-program ·
https://git.savannah.gnu.org/git/grub.git: grub2 · https://access.redhat.com/downloads/content/package-browser/: grub2 · https://access.redhat.com/downloads/content/package-browser/: grub2
GO-2026-6599Published
Reset context tracking on consecutive template expressions in html/template
osv · BIT-golang-2026-94448 · CVE-2026-94448
Go: stdlib
GO-2026-6610Published
HTTP/2 transport accepts malformed framing-related headers in net/http
osv · BIT-golang-2026-78660 · CVE-2026-78660
Go: stdlib · Go: stdlib · Go: golang.org/x/net
GHSA-cx2f-j9fh-8g68Published
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
osv · BIT-mariadb-2026-107382 · BIT-mariadb-min-2026-107382 · BIT-mysql-client-2026-107382 · CVE-2026-107382
npm: mariadb
GO-2026-6605Published
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
osv · BIT-golang-2026-56866 · CVE-2026-56866
Go: stdlib
GHSA-r3rv-jm3r-62q2Published
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
osv · BIT-mariadb-2026-107385 · BIT-mariadb-min-2026-107385 · BIT-mysql-client-2026-107385 · CVE-2026-107385
npm: mariadb · npm: mariadb · npm: mariadb
GO-2026-6617Published
HTTP/2 server crash due to HPACK encoder race in net/http
osv · BIT-golang-2026-97032 · CVE-2026-97032
Go: stdlib · Go: stdlib · Go: golang.org/x/net
GO-2026-6608Published
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
osv · BIT-golang-2026-94440 · CVE-2026-94440
Go: stdlib
GHSA-v6pj-gxxw-phfwPublished
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
osv · BIT-mariadb-2026-107384 · BIT-mariadb-min-2026-107384 · BIT-mysql-client-2026-107384 · CVE-2026-107384
npm: mariadb · npm: mariadb · npm: mariadb
GO-2026-6612Published
Double flow control refund on HTTP/2 server streams in net/http
osv · BIT-golang-2026-78663 · CVE-2026-78663
Go: stdlib · Go: stdlib · Go: golang.org/x/net
GO-2026-6609Published
Lack of limit on size of parsed Range headers in net/http
osv · BIT-golang-2026-78667 · CVE-2026-78667
Go: stdlib
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.