CVE-2026-88829Published
Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: busybox
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694926 source statements · aliases may refer to the same vulnerabilityCVE-2026-105067Published
WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: modern-events-calendar-lite
CVE-2026-107422Published
WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: wp-w3all-phpbb-integration
CVE-2026-53613Published
util-linux mount target TOCTOU allows local privilege escalation
cve-program ·
Vendor product: util-linux
CVE-2026-91882Published
Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in the API client error handling component. An unauthenticated attacker…
cve-program ·
Vendor product: Terraform Provider for OME
CVE-2026-77572Published
VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt
cve-program ·
Vendor product: VeraCrypt
CVE-2026-53614Published
util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass
cve-program ·
Vendor product: util-linux
CVE-2026-53615Published
util-linux libblkid DOS extended-partition overflow produces invalid partition metadata
cve-program ·
Vendor product: util-linux
CVE-2026-59951Published
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
cve-program ·
Vendor product: python-sdk
CVE-2026-92153Published
F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath
cve-program ·
Vendor product: fprime
CVE-2026-103988Published
FileRise renameFolder omits destination-parent authorization
cve-program ·
Vendor product: FileRise
CVE-2026-92155Published
F´: FileUplink Unknown Packet Type Assertion DoS
cve-program ·
Vendor product: fprime
CVE-2026-92160Published
F´: SendPartial Integer Overflow Leading to Assertion DoS
cve-program ·
Vendor product: fprime
CVE-2026-76083Published
Redash: JSON data source query URL can bypass base URL restriction
cve-program ·
Vendor product: redash
CVE-2026-104103Published
Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members
cve-program ·
Vendor product: ludwig
CVE-2026-103930Published
cpp-httplib open_stream serializes CRLF in request target into HTTP request line
cve-program ·
Vendor product: cpp-httplib
CVE-2026-63626Published
Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)
cve-program ·
Vendor product: mongoose
CVE-2026-102748Published
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
cve-program ·
Vendor product: dgraph
CVE-2026-108961Published
PaddlePaddle PaddleX Preprocessor processors.py NormalizeImage.__init__ code injection
cve-program ·
Vendor product: PaddleX
CVE-2026-104143Published
DataEase: Stored SQL Injection via dateFormat field templates
cve-program ·
Vendor product: dataease
CVE-2026-110666Published
cemtan sar2html File Upload sar2html.py updateDb path traversal
cve-program ·
Vendor product: sar2html
CVE-2026-54525Published
Markdown Preview Enhanced: One Click RCE via Markdown Link Command Injection on Windows
cve-program ·
Vendor product: vscode-markdown-preview-enhanced
CVE-2026-55384Published
InvoiceShelf trusts client-supplied document totals
cve-program ·
Vendor product: InvoiceShelf
CVE-2026-103975Published
Appium: Symlink based Zip Slip in @appium/support ZIP extraction
cve-program ·
Vendor product: appium
CVE-2026-61843Published
FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
cve-program ·
Vendor product: FileRise
CVE-2026-55382Published
InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)
cve-program ·
Vendor product: InvoiceShelf
CVE-2026-55680Published
WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter
cve-program ·
Vendor product: WeGIA
CVE-2026-55684Published
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
cve-program ·
Vendor product: WeGIA
CVE-2026-71854Published
OpenAEV has unauthenticated access and missing object-level authorization on player lessons API
cve-program ·
Vendor product: openaev
CVE-2026-110670Published
cemtan sar2html Archive Processing sar2html.py updateDb sql injection
cve-program ·
Vendor product: sar2html
CVE-2026-62664Published
FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root
cve-program ·
Vendor product: FileRise
CVE-2026-69193Published
FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying
cve-program ·
Vendor product: FileRise
CVE-2026-104106Published
FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification
cve-program ·
Vendor product: FileRise
CVE-2026-110695Published
turboderp ExLlamaV2 Safetensors Tensor Loader stloader.py STFile.get_tensor buffer overflow
cve-program ·
Vendor product: ExLlamaV2
CVE-2026-110809Published
sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of service
cve-program ·
Vendor product: SGLang
CVE-2026-109695Published
WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
cve-program ·
https://wordpress.org/plugins: fluent-cart
CVE-2026-109786Published
In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can us…
cve-program ·
Vendor product: fail2ban
CVE-2026-109702Published
WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: share-button
CVE-2026-105882Published
WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: user-registration
CVE-2026-93484Published
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary …
cve-program ·
Vendor product: Znuny
CVE-2026-76664Published
HPE NonStop EXPAND - Out-of-Bounds memory read/write
cve-program ·
Vendor product: HPE NonStop EXPAND
CVE-2026-76665Published
HPE NonStop EXPAND - Buffer Overflow vulnerability
cve-program ·
Vendor product: HPE NonStop EXPAND
CVE-2026-76666Published
HPE NonStop EXPAND - Out-of-Bounds memory read
cve-program ·
Vendor product: HPE NonStop EXPAND
CVE-2026-55573Published
e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain
cve-program ·
Vendor product: e107
CVE-2026-76667Published
HPE NonStop EXPAND - Out-of-Bounds memory read vulnerability
cve-program ·
Vendor product: HPE NonStop EXPAND
CVE-2026-101217Published
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this vu…
cve-program ·
Vendor product: Unisphere for PowerMax vApp
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.