Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
697814 source statements · aliases may refer to the same vulnerabilityNginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
cve-program ·
Vendor product: nginx-ui
Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking
cve-program ·
Vendor product: pingvin-share-x
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
cve-program ·
Vendor product: pyload
Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices
cve-program ·
Vendor product: HB810(US2) V1.0/1.6/2.0/2.6 · Vendor product: HB810(EU1) V2.0 · Vendor product: HB710(US2) V1.6/1.0
WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: simply-schedule-appointments
Privilege Escalation via Improper Authorization in User Management in multiple TP-Link Aginet Devices
cve-program ·
Vendor product: HB810(US2) V1.0/1.6/2.0/2.6 · Vendor product: HB810(EU1) V2.0 · Vendor product: HB710(US2) V1.6/1.0
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
cve-program ·
https://pkg.go.dev: net/http
Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
cve-program ·
Vendor product: HB810(US2) V1.0/1.6/2.0/2.6 · Vendor product: HB810(EU1) V2.0 · Vendor product: HB710(US2) V1.6/1.0
Improper Access Control through REST API Endpoints in Splunk Secure Gateway
cve-program ·
Vendor product: Splunk Enterprise · Vendor product: Splunk Secure Gateway
Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise
cve-program ·
Vendor product: Splunk Enterprise
Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise
cve-program ·
Vendor product: Splunk Enterprise
Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway
cve-program ·
Vendor product: Splunk Enterprise · Vendor product: Splunk Secure Gateway
Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB
cve-program ·
https://github.com/FalkorDB/FalkorDB: FalkorDB
Type confusion in FalkorDB GRAPH.QUERY via the --bolt argument
cve-program ·
https://github.com/FalkorDB/FalkorDB: FalkorDB
Ops Manager Improper Authorization in Daily Host Monitoring Retrieval
cve-program ·
Vendor product: Ops Manager
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document th…
cve-program ·
Vendor product: affinity
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an…
cve-program ·
Vendor product: affinity
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat a…
cve-program ·
Vendor product: affinity
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflo…
cve-program ·
Vendor product: affinity
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft…
cve-program ·
Vendor product: affinity
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affi…
cve-program ·
Vendor product: affinity
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted p…
cve-program ·
Vendor product: affinity
Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated
cve-program ·
Vendor product: Crux Agent
Stored XSS in TMT Machine's Talassoft Industrial Management Software
cve-program ·
Vendor product: Talassoft Industrial Management Software
Docker Desktop for Windows installer failed to verify external packages
cve-program ·
Vendor product: Docker Desktop
Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)
cve-program ·
Vendor product: openPDC · Vendor product: openPDC (Docker image) · Vendor product: openHistorian
Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code
cve-program ·
Vendor product: openPDC · Vendor product: openPDC (Docker image) · Vendor product: openHistorian
Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership
cve-program ·
https://illumos.org: SUNWcs · Vendor product: OmniOS
Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon
cve-program ·
Vendor product: SUNWcs
Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones
cve-program ·
https://illumos.org: system/zones · Vendor product: OmniOS
Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory
cve-program ·
https://illumos.org: SUNWcs · Vendor product: OmniOS
NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon
cve-program ·
https://illumos.org: SUNWcs · Vendor product: OmniOS
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
cve-program ·
Vendor product: nginx-ui
MariaDB: Insecure $HOME in MariaDB rpm packages
cve-program ·
Vendor product: server
Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
cve-program ·
https://github.com/keycloak/keycloak: keycloak · https://access.redhat.com/downloads/content/package-browser/: Red Hat Build of Keycloak · https://access.redhat.com/downloads/content/package-browser/: Red Hat Build of Keycloak
Portabilis i-Diario justificativas-de-falta cross site scripting
cve-program ·
Vendor product: i-Diario
Double flow control refund on HTTP/2 server streams in net/http
cve-program ·
https://pkg.go.dev: net/http · https://pkg.go.dev: net/http/internal/http2 · https://pkg.go.dev: golang.org/x/net/http2
Portabilis i-Diario conteudos cross site scripting
cve-program ·
Vendor product: i-Diario
Portabilis i-Diario justificativas-de-falta Endpoint doc_uploader.rb cross site scripting
cve-program ·
Vendor product: i-Diario
OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio
cve-program ·
Vendor product: sagemaker-distribution
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS
cve-program ·
Vendor product: loom
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS
cve-program ·
Vendor product: loom
Missing authentication for critical function in Loom for AWS
cve-program ·
Vendor product: loom
Uncontrolled recursion in the Ion reader in Amazon Ion Python
cve-program ·
Vendor product: ion-python
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.