CVE-2026-77226Published
Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint
cve-program ·
Vendor product: Camunda 7
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
698142 source statements · aliases may refer to the same vulnerabilityCVE-2025-15591Published
Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management
cve-program ·
Vendor product: Content Management
CVE-2026-106113Published
ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
cve-program ·
Vendor product: ImageSharp
CVE-2026-106448Published
StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding
cve-program ·
Vendor product: stablelib
CVE-2026-106453Published
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError
cve-program ·
Vendor product: lz4-java
CVE-2026-106458Published
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
cve-program ·
Vendor product: backstage · Vendor product: plugin-catalog-backend-module-bitbucket-server
CVE-2026-106463Published
Backstage: Improper authorization in GitLab organizational user ingestion
cve-program ·
Vendor product: backstage · Vendor product: plugin-catalog-backend-module-gitlab
CVE-2026-106490Published
Backstage: Improper input validation in TechDocs static content requests
cve-program ·
Vendor product: backstage · Vendor product: plugin-techdocs-backend
CVE-2026-106496Published
Backstage: Inconsistent enforcement of allowed location types during catalog processing
cve-program ·
Vendor product: backstage · Vendor product: plugin-catalog-backend
CVE-2026-106570Published
ImageMagick: Denial of service in distributed pixel cache server
cve-program ·
Vendor product: ImageMagick
CVE-2026-106501Published
Backstage: Sensitive information exposure in Scaffolder
cve-program ·
Vendor product: backstage · Vendor product: plugin-scaffolder-backend
CVE-2026-106506Published
Backstage: Improper input validation in scaffolder task list ordering
cve-program ·
Vendor product: backstage · Vendor product: plugin-scaffolder-backend
CVE-2026-93677Published
Langflow OSS is affected by multiple vulnerabilities
cve-program ·
Vendor product: Langflow OSS
CVE-2026-106471Published
Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching
cve-program ·
https://access.redhat.com/downloads/content/package-browser/: candlepin
CVE-2026-102173Published
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
cve-program ·
Vendor product: Kirki – Freeform Page Builder, Website Builder & Customizer
CVE-2026-42710Published
WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: slider-wd
CVE-2026-106056Published
Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting
cve-program ·
Vendor product: rundeck
CVE-2026-105138Published
Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API
cve-program ·
Vendor product: obot
CVE-2026-45161Published
wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
cve-program ·
Vendor product: wger
CVE-2026-62179Published
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
cve-program ·
Vendor product: praisonai-platform
CVE-2026-106561Published
Backstage: Sensitive information disclosure in Kubernetes resource queries
cve-program ·
Vendor product: backstage · Vendor product: plugin-kubernetes-backend
CVE-2026-106566Published
ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check
cve-program ·
Vendor product: ImageMagick
CVE-2026-107205Published
LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API
cve-program ·
Vendor product: LMCache
CVE-2026-106571Published
ImageMagick: Heap Buffer Over-Write in GetVirtualPixels api will result in a crash
cve-program ·
Vendor product: ImageMagick
CVE-2026-106576Published
ImageMagick: Denial of service possible when parsing an XMP profile.
cve-program ·
Vendor product: ImageMagick
CVE-2026-107270Published
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
cve-program ·
Vendor product: gophish
CVE-2026-106580Published
ImageMagick: Policy Bypass in CUT encoder
cve-program ·
Vendor product: ImageMagick
CVE-2026-62176Published
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation
cve-program ·
Vendor product: PraisonAI
CVE-2026-76454Published
Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability
cve-program ·
Vendor product: Cisco License On-Prem
CVE-2017-12149Published
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization a…
cve-program ·
Vendor product: jbossas
CVE-2026-105324Published
An HTTP header injection vulnerability was found in the ADM
cve-program ·
Vendor product: ADM
CVE-2026-39600Published
WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerability
cve-program ·
https://wordpress.org/plugins: aculect-ai-companion
CVE-2026-96890Published
Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts
cve-program ·
Vendor product: Enterprise Server
CVE-2026-103620Published
Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL
cve-program ·
Vendor product: Enterprise Server
CVE-2026-106512Published
MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS
cve-program ·
Vendor product: sachertortephp
CVE-2026-106513Published
MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change
cve-program ·
Vendor product: MISP
GHSA-pq96-jpmf-w254Published
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
osv · CVE-2026-106102
npm: quasar
GHSA-95p4-vv4g-jxxmPublished
Backstage may expose sensitive information in Scaffolder task failure events
osv · CVE-2026-106502
npm: @backstage/plugin-scaffolder-backend
GHSA-4ww4-68q3-h7g5Published
Payload: Field-level write access bypass in Payload on MongoDB
osv · CVE-2026-106100
npm: @payloadcms/db-mongodb · npm: @payloadcms/db-mongodb
GHSA-cm77-ch27-6w6vPublished
Backstage has potential file exposure through local TechDocs publisher
osv · CVE-2026-106508
npm: @backstage/plugin-techdocs-node
GHSA-q9mq-245r-4g93Published
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
osv · CVE-2026-106109
npm: @quasar/app-vite
GHSA-f7v3-xhm6-w245Published
Backstage has improper input validation in TechDocs Markdown extension configuration
osv · CVE-2026-106557
npm: @backstage/plugin-techdocs-node
GHSA-w7x8-q2gp-5cggPublished
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
osv · CVE-2026-73487
npm: flowise · npm: flowise-components
GHSA-r5mf-4r5x-q78fPublished
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
osv · CVE-2026-106106
npm: @quasar/render-ssr-error · npm: @quasar/app-vite
GHSA-fh39-c73x-5pjvPublished
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
osv · CVE-2026-106105
npm: @quasar/ssl-certificate · npm: @quasar/cli · npm: @quasar/app-vite
GHSA-5m6h-8g35-p3m7Published
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
osv · CVE-2026-106107
npm: @quasar/app-vite
GHSA-68jq-fhch-4xq4Published
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
osv · CVE-2026-106104
npm: quasar
GHSA-vwp5-f99x-x3rqPublished
Backstage has improper input validation in scaffolder task list ordering
osv · CVE-2026-106506
npm: @backstage/plugin-scaffolder-backend
GHSA-vhhq-m2gm-rwc9Published
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
osv · CVE-2026-106108
npm: @quasar/app-vite
GHSA-4xvq-3m68-h444Published
Backstage has sensitive information exposure in scaffolder task logs
osv · CVE-2026-106504
npm: @backstage/plugin-scaffolder-backend
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.