CVE-2026-73135Published
Gitea hidden-owner repository listing disclosure
cve-program ·
Vendor product: gitea.dev
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695687 source statements · aliases may refer to the same vulnerabilityCVE-2026-73273Published
Gitea Maven checksum upload quota bypass and memory exhaustion
cve-program ·
Vendor product: code.gitea.io/gitea
CVE-2022-21505Published
In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot para…
cve-program ·
Vendor product: Oracle Linux
CVE-2022-21166Published
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
cve-program ·
Vendor product: Intel(R) Processors
CVE-2022-21125Published
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
cve-program ·
Vendor product: Intel(R) Processors
CVE-2022-21123Published
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
cve-program ·
Vendor product: Intel(R) Processors
CVE-2022-20572Published
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not n…
cve-program ·
Vendor product: Android
CVE-2022-20566Published
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Pr…
cve-program ·
Vendor product: Android
CVE-2022-20422Published
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not nee…
cve-program ·
Vendor product: Android
CVE-2026-102988Published
Plane: ORM Field Injection via Unvalidated `order_by` Parameter (Including Unauthenticated Path)
cve-program ·
Vendor product: plane
CVE-2026-81507Published
ESF-IDF: Bluetooth Classic L2CAP Heap Memory Disclosure Allowing Unauthorized Access to Sensitive Data
cve-program ·
Vendor product: esp-idf
CVE-2026-103028Published
SFTPGo source-side file-pattern filter bypass during copy operations
cve-program ·
Vendor product: sftpgo
CVE-2026-109523Published
girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection
cve-program ·
Vendor product: Online-Appointment-Booking-System
CVE-2026-110359Published
Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit t…
cve-program ·
Vendor product: Desktop Host
CVE-2026-110451Published
Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
cve-program ·
Vendor product: Nix
CVE-2022-20421Published
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for e…
cve-program ·
Vendor product: Android
CVE-2026-76655Published
HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerability
cve-program ·
Vendor product: HPE NonStop SNMP Trap Multiplexer
CVE-2026-73798Published
HPE NonStop DNS 9.2.3 Non Secure Version
cve-program ·
Vendor product: HPE NonStop DNS 9.2.3 Non Secure Version
CVE-2026-73797Published
HPE NonStop TSQLFIL - Memory corruption vulnerability
cve-program ·
Vendor product: HPE NonStop TSQLFIL
CVE-2026-73796Published
HPE NonStop TSQLEXE - Memory Corruption vulnerability
cve-program ·
Vendor product: HPE NonStop TSQLEXE
CVE-2026-73795Published
HPE NonStop TMF Auditread2 - Denial of Service vulnerability
cve-program ·
Vendor product: HPE NonStop TMF Auditread2
CVE-2026-90530Published
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
cve-program ·
Vendor product: ColdFusion 2025 · Vendor product: ColdFusion 2023
CVE-2026-75996Published
ColdFusion | Uncontrolled Resource Consumption (CWE-400)
cve-program ·
Vendor product: ColdFusion 2025 · Vendor product: ColdFusion 2023
CVE-2026-105994Published
ColdFusion | Incorrect Authorization (CWE-863)
cve-program ·
Vendor product: ColdFusion 2025 · Vendor product: ColdFusion 2023
CVE-2026-106616Published
ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
cve-program ·
Vendor product: ColdFusion 2025 · Vendor product: ColdFusion 2023
CVE-2026-105896Published
Photoshop Desktop | NULL Pointer Dereference (CWE-476)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-95640Published
Photoshop Desktop | NULL Pointer Dereference (CWE-476)
cve-program ·
Vendor product: Photoshop · Vendor product: Photoshop
CVE-2026-100130Published
Substance3D - Sampler | Out-of-bounds Read (CWE-125)
cve-program ·
Vendor product: Substance 3D Sampler
CVE-2026-100131Published
Substance3D - Sampler | Out-of-bounds Read (CWE-125)
cve-program ·
Vendor product: Substance 3D Sampler
CVE-2026-103829Published
Substance3D - Designer | NULL Pointer Dereference (CWE-476)
cve-program ·
Vendor product: Substance 3D Designer
CVE-2026-103828Published
Substance3D - Designer | NULL Pointer Dereference (CWE-476)
cve-program ·
Vendor product: Substance 3D Designer
CVE-2026-103827Published
Substance3D - Designer | Stack-based Buffer Overflow (CWE-121)
cve-program ·
Vendor product: Substance 3D Designer
CVE-2026-103826Published
Substance3D - Designer | NULL Pointer Dereference (CWE-476)
cve-program ·
Vendor product: Substance 3D Designer
CVE-2026-103824Published
Substance3D - Designer | NULL Pointer Dereference (CWE-476)
cve-program ·
Vendor product: Substance 3D Designer
CVE-2026-103823Published
Substance3D - Designer | Stack-based Buffer Overflow (CWE-121)
cve-program ·
Vendor product: Substance 3D Designer
CVE-2026-103825Published
Substance3D - Designer | Out-of-bounds Read (CWE-125)
cve-program ·
Vendor product: Substance 3D Designer
CVE-2026-103822Published
Substance3D - Designer | Out-of-bounds Read (CWE-125)
cve-program ·
Vendor product: Substance 3D Designer
CVE-2026-100126Published
Bridge | Out-of-bounds Read (CWE-125)
cve-program ·
Vendor product: Adobe Bridge · Vendor product: Adobe Bridge
CVE-2026-103820Published
CAI Content Credentials | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK
CVE-2026-105900Published
ColdFusion | Improper Input Validation (CWE-20)
cve-program ·
Vendor product: ColdFusion 2025 · Vendor product: ColdFusion 2023
CVE-2026-109963Published
Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php
cve-program ·
Vendor product: froxlor
CVE-2026-102603Published
Gotify: Insufficiently Protected Password Change endpoint
cve-program ·
Vendor product: server
CVE-2022-4662Published
A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.
cve-program ·
Vendor product: Kernel
CVE-2026-100139Published
CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK
CVE-2026-105902Published
CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK
CVE-2026-95634Published
CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK
CVE-2026-100137Published
CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK
CVE-2026-106627Published
CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK
CVE-2026-100138Published
CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)
cve-program ·
Vendor product: Content Credentials Rust SDK · Vendor product: C2PA Tool · Vendor product: Content Credentials JS SDK
CVE-2022-4450Published
Double free after calling PEM_read_bio_ex
cve-program ·
Vendor product: OpenSSL
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.